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Chapter 1%: Introduction 


121 Purpose 


This document is a manual for system administrators oan the 
Multics system. It does not describe the internal structure of 
the system-administration data bases or the oroarams which 
manioulate thems consult the MPM SPS) and the MSPM for these 
detaifs. This manual is intended to be a useful auide for the man 
who Aas to set up and run a Multics system. 


1.2 Resource Control 


The overall job of the Multics system-administration programs is 
to contro! the use of sysfem resources and to keen records about 
how they were used, They must atso support rationing of 


resources, orovide system security servicess and produce usage 
renorts and bills as required. 


Multics resources are used by ltogged-in users, each of whom has 
(at least one) o9rocess under his control. The user 15 
identified, when he attemots to tog ins by his person ID and AIs 
project ID. A process is then created for him, and his resource 
usage is metered by various hard-core modules. These meter 
readings are collected and kent in the Multics storage system, 
and are made available to the resource-monitorirg and biiting 
programse 


In order to flog a user in, some process must execute a prodram 
which reads the supplied togin request tine and »voassword, and 
checks them agains the ftist of valid users, aftso kent in the 
Multics storage system. To provide maximum protection for this 
segment, the orocess In which the ftogin proaram executes Is a 
fictitious user of the system, called the “answering service.™ 
(This oprocess Is also called the “initializer process," because 
it is the orocess created during the system initialization 


Sequenca,s and the “system contro! orocess.") Almost all 
resource-usage metering functions are performed in the 
initlaltizer orocess. The generic term for the thirty or so 
orograms which deal with system resource control is “user 


control” or “system control." 


The administrative and resource-contro! functions of Multics 
comoris2 a sizable subsystem, which, fike the rest of the 
operating system,. is designed to continue to arows, and to allow 
many ootional facilities which a oarticular Instalfation may 
decide to bypass. 
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The system administration facilities are organized into several 


functional areas, with well-defined interfaces. There are six 
major areas, each of which contains several subsystems. 


1. 


N 
ry 


Hardcore resource multioltexing and metering. The central 
part of the supervisor, esnecially the Traffic Control, Page 
Control, and fault and Interrupt service modules, has 
orimary resnoonsibillty for poroviding users with access’ fo 
the system*s resourcese These modules also keen extremely 
fine-grained meters which record the usage of each process. 


Hardcore interfaces to the user. The Multics Storage System 
orovides Nirectory Controt services which organize data for 
a user and control access to datas and keen fine-grained 
meters and quotas on storage usage. The Interprocess 
Conmunication facilities allow for synchronization of and 
cooperation between processes. 


Atner suoervisor services. Other tape and data-management 
services are atso provided by the Multics sunervisor fo 
allow users access to system resources and to controt the 
manner in which these resources are used. 


System control. User Identification and tlogin control, 
basic accounting functions, flle backup, contro! of shared 
devices such as line orinters, and operator communication 
are orovided by system control. 


System Administration. User registration services and 
billing overations are per formed by the sysfem 
administrators. This manual is primarily a  gquide to the 
ooeration of programs In the system administration area. 


User project administration. Some grouos of users may have 
the ability to manage some of their own resources. This 
manual, and the Multics Project Administrator’®s Manual, 
describe operations In the user prolect administration area. 
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1.3 System administrators 

There are three kinds of system administrators’ 
1. Unrestricted system administrators. 
2. Restricted system administrators. 
3. Project administrators. 


The system administrators are users of Multics ftike any other 
users. They nust log in the same way that other users do, and 
when thay fog in a process is created for them in the same way as 
for other users. They differ from other users of Multics In that 


yee They have access to certain segments which regular users 
do not. Tt is possibtie, but not necessary, for them to have 
access to all segments in the system. 


2. They use soecial orograms to manioulate the accounting 
data bases. In general, these proarams do not make 
orivileged calls? they are ordinary PL/1 nmrograms which 
manipulate data in ordinary ways. The data for these 
programs, though, are accounting records and control 
segments which normal users have no access to. 


3. The system will grant certain requests for them which it 
will not grant for normaf users. TN oarticular, the 
initializer orocess will install system tables for system 
adninistrators, to change passwords or add new users. 


i, Some privileged calts are availabtie to the sysfem 
administrators. A system administrator is aulte often a 
very exnerienced system orogrammer, and so some  soeciat 
abilities, such as the privilege of being able to natch the 
system, are avallable to the system administrators. Almosf 
no use of this ability is made in the design of the 
system-administration package. 


The restricted and unrestricted system administrators are users 
on the project “SysAdmin". Since they therefore have access to 
the system-administration segments and orograms, they can 
comonletaly control) the systems resources. A restricted system 
adninistrator has a special initial procedure, 


accounts_overseer_ 
which orovides him with a speclal set of commands designed for 


system administration. Although a restricted system 
administrator has access control orivileaes which would 
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ootentialty enab!te him to destroy any segment In the system, he 
is traoved in his soecial command system, and so can onty perform 
soecific accounting functions. 


An unrestricted system administrator can use any Multics command. 
(He may also use the svoecial command system.) Pecause the 
unrestricted system administrator can cause damage to the segment 
hierarchy, circumvent access control restrictions, and destroy 
resource accounting, onty careful and carefully-trained 
programmers with a good Knowledge of Multics should operate as 
unrestricted system administrators. 


Project administrators are in charge of a particular project. A 
system administrator can function as a oroject administrator for 
any oroject. Initiattys alt projects are set up with onty the 
system administrators. If a project needs more contro! over ifs 
usage than the system administrators can oprovide, they may 
delegat2= controt of the oroject to a project administrator. 
Project administrators, too, can cause damage to segments, buf 
only those of their projects. They should therefore be 
responsible Individuals who are wllttiing to do the necessary work 
fo keeo onrojects running smoothty.e. Project administrators are 
usually normal Multics orogrammers who have taken on additional 
responsibitities: they are given no speclal command system, but 
certaln commands wit! work for them which willtf not work § =“for 
non-administrators. 


Multics System Administrator's Manual Page 9 
01/09/73 rey 3 


Chaoter 1 Introduction 


1.2% Definitions 


A person is a human being or somethina (such as a daemon) that is 


treated like one by the system. Each registered person is 
identified by a string of one to 22 characters, bealinning with a 
capita! tetter, called a person [Ds which is unique wifhin the 


instalitation. Usually, the person ID Is the person’s tast name, 
Each oerson has several attributes which the system remembers, 
inctuding a personal pnassword and a default project ff. These 
items, along with information about the user such as full name 
and titte, malling address, and orogrammer number, are maintained 
by the system administrators. 


The term user is used in two different ways. We often speak of a 
logged-in person as a users ands sometimes, use the term to refer 
to the process which the user is controlling from his terminal. 
Esoeclaliy In the context of user control, however, we annoly fhe 
term yser to any member of the set of users (in the first sense) 
who could toq In. In other wordss we sceak of a user as a 
registered identity. ; 


A project is a grouping of users for resource controt ourvoses. 
Fach oroject is identified by a string of from one to nine 
characters, beginning with a cavital letter or a digits called a 
Prolect IDs» which is unique within the instaltation. 


Each user is associated with a oroject. The user Is identified 
for access contro! purposes by the concatenation of his person ID 
ani his project ID. A nerson may be registered as 3 user on more 
than one oroject: we consider him to be two different users in 
this case. 


Since the nroject ID makes up the second comoonent of each 
user's access control name, permission to tog In on ae project 
confers the ability to reference certain segments. 


The list of persons who may log in on a project is contained In a 
segment within the Multics storage system. This segment Is 
accessible onty to the system and to the system administrator. 
The segment Is known as a project definitlon tabie (odt). There 
is one entry in the odt for each user, which contains the user's 
attributes and usage information for the current month. 


Each oroject has an administrator associated with ite The 
administrator for a protect may be the system administrator, or 
the project administrator may be some other user of Multics. 
Project administrators wilt receive monthly usage reports 
describing the activity of users of the oroject. 


A protect directory is established for each oroject. This 
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directory is contained In the directory "“>user_dir_dir™. It 
usuatty contains a home directory for each user of the project, 


althougy the project administrator may snecify some other 
arranagenent. The project directory has a disk quotas which 
limits the total amount of disk storage which the oroject = may 
occupy. The project administrator may subdivide this quota among 
directories Inferlor to the project directory, or he may elect to 
allow some or all of the directories inferior to the oroject 
directory to have a zero quota, and to charge thelr usage fo the 
oraxject directory aquofa. 


Each oroject is a member of a load control group, which is a 
aroauoiny of projects which share a guaranteed access to the 
system. Each load control group has a quota of “primary” toad 
units ahich represents a quaranteed number of users from fhe 
grouo who wit! be abte to tog ine Users in excess of the grouo‘’s 
quota will be allowed to log in if the system Is not full, buf 
wlll be subject to oreemotilon by orimary users from other grouns. 
The orsdject administrators for the orojects of a groun may 
cooperate to control who from the group may have crimary status, 
and for how ltlona. 


The load control grouo feature can be used to satisfy large 
customers of the system, while protecting the small user °s 
abilltv to be able to access the system. This feature of Multics 
is ootional, though! an installation may simoly put all users In 
the sans group and bynoass the facllity entirely. 


Multics System Administrator's Manual 


91/09/73 


Chaoter 2 


Page iti 
rey 3 


Nirectory Structure and Seaments 


The following 
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of the system directory 
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2e1 >system_control!_dir 


The most imoortant directory for the system-administration 
oroarams Is the Initlaltizer'‘s home directory, 


>system_control_dir 


This directory, right off the root, contains those segments 
referenced by the Initializer during the processes of 


1. Logging In a user 

2 Logging out a user 

3e Accounting for user usage 

ke Instaltting new system-administration tatles 
5. System startup 


The contents of this directory include the following special 
seqments?: 


lines the list of GIOC channels to accept diatups 
and togins from, referenced at system 
start-up. 


sat the System Administrator’s Table, containing 
an entry for each teqal oroject olus some 
per-system quantities. Tris table is 


referenced at every togin,g to validate the 
user®s project Id. 


instalftation_parms Installatilon-defined constants, including 
shift definitions and orices 


ont the Person Name Table, containing the 
identification of af! reaistered persons. 
This table Is accessed at most togins, to 
determine the user‘’s password. 


TO0__ accounting the I0 daemon accounting records, one “card” 
per orint or ounch operation 


staf_seg on-line system statistics sampled every 
accounting update 


answer_table a table which has an entry for each terminal 
line, with the name and accounting data and 
process id of the user tloaged In on it 


whotab the oublic tist of logged-in users 


absentee_user_tab the “answer_tablie™ for absentees 
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absenteaN.ms the absentee user job queue for queue N 
ont.ht a hash table for the pont 


message_of_the_day a message tyned by the user process during 
fhe normal process startup 


oroj_adnin_seg a segment oublishing the Initilatizer*s event 
channel used to signal uodates of 
system-contro! tables by administrators 


109 the iInitiallzer'ts log of events of Interest. 
Many initializer messages are tyned to the 
operator and also recorded in this segment. 


admin.ec a speciat seament giving sequences of 
commands which ovoerators may be allowed fo 
execute as macro-operations. 


login_heto a segment which is tyvoed if a user says 
"nelip™ instead of “login™ 


master_group_table a table giving the auaranteed toad units for 
each toad control group ard fisting the 
groups" current occusancy. This table Is 
accessed at each togin to determine whether 
the attempted f!ogin would overload the 
system. 


In addition, other segments may be kept in >system_control_dir, 
such as segments necessary for system reloads. 


There are two subdirectories of  >system_control_dir which are 
imoortant. The first directory, 


>system_control_dliroodt 
contains a pdt for each legal project. Whenever a user togs In, 
his odt entry Is tocated in his project*s odt,. and the user’s 
attributes are used to Initialize his process. The usage data 
figures In these pdt*s are updated while the system is running. 
The second subdirectory, 


>system_control_diroinstall 


is used when an administrator requests the Installation of a new 
cooy of a system table. 
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2.2 >user_dir_dir SysAdmin 


Another imoortant directory is the system administration's 
project directory, 


>user_dir_dir>SysAdmin 


and the directories and segments inferlor to If. 


Ce2ealt >user_dir_dir>SysaAdmin>admin 


All data segments nertaining to system administration should be 
keot in ae$single directory inferlor to >udd>SysAdmin. At MIT, 
this directory is calted 


>uid>SysAdmin>admin 
Tt contains the following: 


ur f the user registration segment, giving names 
and addresses, and person ID°s. This seqment 
is used when a person tis registered, to 
guarantee that his person ID is unique at the 
Installation. 


urf.ehnt a hash table for this segment 


reafile the requisition segment, containing account 
number, bliting address, total charges, and 
requisition number for each usage account. 


projfite the prolect segment, containing descriotive 
Information about each project, iInctuding 
title, supervisor address, and disk storagqe 


usage. 
miscfile the miscellaneous charges and credits Journal 
pmf.earchive an archive of all omf*s for projects run by 


the system administrator 


PNT.ont a copy of the system pnt 
ontent a hash table for this segment 
smf.cur the current smf This is converted to a sat by 


"cev_smf” 
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smf.cur.sat a copy of the current sat 

disk_stat a segment giving disk quota and usage for all 


directories with suofta 


installation_parms a backup copy of the same segment in 
>system_control!_dir 


lines a hackup copy of the same segment in 
>system_control_dir 


smf .new the next version of the smf. some commands 
make changes to this segment. All chanaes can 
be put into effect by tynina “new_smf” 


cutrof a report, showing accounts which are cut off, 
prepared dally 


sumry a renort of account status, orenared daily 


diskreport a report, giving project disk usage, prepared 
on request 


delegated_omf.archive an archive of alJ pmf*s for detegated 
projects, giving the omf at the time of 
delegation. Changes by oroject administrator 
are not reflected. 


daemon_backup.ec this segment becomes an “absin™ segment at 
the end of the month which fists all daemon 
use 

mefer_data a copy of the contents of 


>system_control_1>stat_seq,; made every days 
for use In generating system statistical 
reoorts. 


today.use_totals a statisticat data base which describes 
month-to-date system resource avallabltity 
and usage, 

yesterday.use_totals the orevlous day*’s cooy of today.use_ftotals. 

daily_raport.contro!l a segment which describes which oprolects 
will be summarized under each category in the 
daily and monthty statistical reports. 

system.report the daily statistical report. 


oldomf.archive an archive of omf*s for defeted orojects 
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PNT.ontyn orevious conoles of the pnt, In case of crash 
smfeoldn orevious coples of the smf, In case of crash 
daily_loa_N extracts from the system tloas prepared (for 


orinting each day 


loqjz_selrct_file a segment which controls the program 
“daily_log_nrocess”™ in its selection of 
messages from the toqa for dalty printing 


suffix_list a segment which controls the orogram 
“disk_usage_stat™ in its selection of segment 
names to summarize 


termseg a segment which fists terminals by terminal 
id code, used by “console_report”™ 


termuse 3 a segment which tists the users of each 
terminal created by “consolfe_reoort” 


Qther data seaments kept in this directory Include backup copies 
of billing data for orevious months and other temnorary seqmentse 
It is in this directory that the monthty bitts and statistical 
reoorts are written. 


"Filted™ and orocessed IDN__accounting segments and log files for 
the current month are keot In a soeclal subdirectory, 


>udid>SysAdminr-admin>history 
until the end of the month. 


Every night, the system_control_dir cooles of the sat and =the 
odt*s are copied into the directory 


>udid>SysAdminr-admin>safe_odts 
to orovide backuo billing data. The cooles are afso used at the 
end of a billing period, to reset the usage charges In the system 


odt*s. 


Cooies of the usage totals, "“orojfilte’, and “reqfile™ for 
orevlous months are keotf in another speclal subdirectory, 


>udd>SysAdmin>admin>HF 
for at feast a month, so that The biiiing can be re-run [Lf 


Necessary. These segments should he dumoed to tare and deleted 
after a reasonable period. 
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2.2.2 >user_dir_dir>SysAdmin>tib 


Those segments which are not sensitive, such as 
system-administration programs not contained in the iibrary, are 
Keof in a different directory. This facilitates dumoing of these 
segments separately, and alds In the startup of new 
Installations. At MIT, this second directory Is called 


>udd>SysAdmin>tib 
This “accounting tibrary”™” directory may contain? 


master,.ec the main exec_com seament for the 
administration 


err.ec the exec_com segment invoked when errors 
occur 

biller.ec the exec_com segment Invoked for bliling 

sys_admin_data the interlock to orevent multiple editing of 


the same segment 


value_seg a symbol-table segment which gives the vatue 
of certain constants used in the 
system-administration onerations 


Installation-dependent system administration tools are also keot 
here. Ail system administrators should do a “set_search_dir™ so 
that they use the orograms in this ltibrary. 
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THe foltowing section provides operating instructions for the 
functions available to a system administrator. If the system 
administrator is overating In “restricted” modes under control of 
“"accounts_overseer_", then att he needs to do Is tyne the 
function name followed by its argquments. If a system 
administrator Is operating under controlt of the standard Multics 
overseer, “orocess_overseer_“, he must orecede each command by 
the string “ec master", @.Ga, 


ec master func aras eee 
The examoles given below assume that the administrator Is 


restricted. Lines orefixed by “u)™ are typed by the user and 
lines prefixed by “s)” are typed by the system. 
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add_anon 


Operation? add anonymous user to project 
Command? add_anon 


Usage: This function adds an anonymous user to a 
non-delegated project with given home directory and Initial 
orocedure and (ontional) voassword. 


Example? To add an anonymous user to the project “Proj5"™, 
tyne 


ud) add_anon Proj5 limited _service_system_ >udd>Proy5 
s) Warninat anonymous user has no password 

Ss) r 1557 12.558 40434 

s) Signal from System Control! process? PDT Installed 
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bit 


A A a care REE Mea “eID ER “Pree wa 


Dperatian: run monthty bills 


Command? bit 

Usage? This function caits 

operations. 

Examote: To prenare for bitling, 
u) bill prepare 


To run the bilts, tyoe 
ud) bill run 
To accent a bili, type 


u) bill) accept 


“bitler.ec™ 
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tyoce 


To clean up after the bilts have been written, tyne 


u) bill delete 


See Chaoter & (nage 57) for a comntete explanation of 


process. 


to aid In bitting 


the bilting 
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chaddr 


eS eS eR RTE SPER A OCI rN 


Noeratian? change person's mailfing address 


Command: chaddr 

Ysage? This function calts the “change™ function to change 
a person’s address. This function is used to change Just the 
address for a single nerson. It does not Install the PNT? to do 
this, use “install PNT.ont’” or do a regular change and answer 


yes. The address must be enclosed in quotes. If the address is” 
not sunotied, the otd address will be disotayed, and a change 
accepted. 


Examole: The address must be enclosed in quotes. To change 
the address for “Jones”, type 


u) chaddr Jones “MTT 39-895" 
Ss) r 1557 12.558 &1434 
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chalias 


Qneration change oerson’s alias 


command: chalias (obsolete) 


Usage? This function has been removed from the system. The 
alias feature is not currently recommended, because we do not see 
@ good way to implement it consistently. Design discussions are 
going on about the alias feature, and it wilt be elther 
completely removed or fully suoported. 
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On2ration: modify user registration data 
Command? change 


Usage? This function Is used to review and possibly modify 
user registration data in the urf and ont. Each item is typed 
out, and then the administrator may teave it unchanged by typing 
“no” or a carriage return, or replace it by new data. 


Example: To change the default oroject for the user “Smith, 
tyoe 


u) change 

s) Enter userld 

ur Smith 

s) If you want to change any Item, type the new data. 
s) Otherwise tyoe “no” or hit carriage return, 


s) Name? Smiths, John 

zi Address: MIT 3-001 
ss Programmer number: 1234 
Project? Quark 


ud) Physics 
s) Chanae password? 


u) no 

s) More users to change? 
u) no 

s) Install now? 

ud) yes 


s) Installing new pont. 

s) Instaltation completed. 

s) r 1557 12.558 40434 

s) Signal from System Control process: PNT instatted 


Notes? The user*s name -should be given tast name first, 
then a comma, then first names a space, and middie initial 
followed by a perlode Names of the form “Smith, Je Alfred™ are 
also allowed. If the user has a titie, such as “Prof. "», the 
title should follow the name and be separated from the name by a 
cofone as in “Smith, John J.tProf.”. You may tyne “ston” at any 
time to abort all the changes you have made to a varticular user 
ani start over. In response to the query “Change password?” you 
may answer “ves and then qive a new oassword,. or “verify™ to 
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check that you have the correct password, or “no™“ to feave the 
password as is. The tast name may be up fo 32 characters !ong. 
The first name and middie itinitiat field may be un to 24 
characters. The address field may be un to 32 characters totals’ 
use slashes to senarate lines of address. The programmer number 
and title may each be up to 8 characters long. 
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Qeeration: change person's default project 
Command? chdf_oro] 


Usage? This function calts the “change™ function to change 
a person’s default project. This function is used to change just 
the default oroject for a singte person. It does not instal! the 
PNT: to do this, either type “Instatl PNT.ont™ or do aeregular 
change and answer yes. If the default project Is not currently 
In the nroject segment, a warning message wlll be printed. If 
the default project is not supniled, the otd value willl be 
display2d, and a change accepted. 


Tf tne user has changed his own default project, with the 
“-change_default_project™ argument to togin, this change will not 
be effective. A snecial tool Is avallabte to unrestricted system 
administrators to force the change of a default oroject: this 
program is called “pass_util™. 


Example? To change the person-id “Smith"™ so that his default 
oroject is “Proj]3", type 


u) chdf_oro] Smith Proj3 
s) r 1557 122558 404+34 


Multics System Administrator's Manual Page 26 
01/09/73 rey 3 


Chaoter 3 Administrator Commands 


check_109 


rere ee 


et nee ee mens Soe 


Operation: check tog for info on user 
Command: check_loqg 


Usage! Sometimes a user will comotain that he can*t tog In. 
To fini out why, you can scan the log segment for the messages 
olaced there by the Initlalizer which give the reason. 


Example: To see why “Jones” can*t tog ing type 


u) check_log Jones 

s) 702 09/22/71 1333.2 0 Igqg_cti_?: no 1 Jones.Multics 2741 
022 chn tty302 reason bad_pass 

s) r 1557 12.558 40434 


This message says that the user could not log in becuase he gave 
the wrong password. His terminal ID was 022, and his channel was 
tty302. This message has severity 0 (so it was not typed to the 
onerator, Just toagqged), and is the 702nd entry In the current 
eke iy 


The following is a list of reasons for not toagina a user In? 


bad_pass bad password 

badpers person not In pnt, elther not added or mistyped 

no_name no name given 

pwlocked password ftocked by administrator 

bad_pro]}] project does not exist In safe. may be mistyped 

no_pdt project’s odt is not In >sct>nodt. message with 
stars also tyoed ontine 

not_pdt user not In pdt for project. did you forget to do 
an “uomf?” 

anon_pow bad anonymous-user password 

already user already togged In, and no “mulfin™ flaa 
(absentee does not count) 

no_acct no default account ID 

acct_no project*’s account out of funds or past termination 
date 

nd_path bad oath name for home directory 

hd _nodir what should be home directory is nenedir branch 


hd err some error in getting status of home directory 
nhd_make error creating home directory branch. message in 
log 


hd_where home directory missing, does not seem to be below 
project dir. we will not create. 
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sys_full 
saturafe 
canf_bum 
gr oupmax 
no_grouno 
nf _ nosec 
sysarpfl 
orog_err 
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system full according to toad units 

system full according to maxe number of users 
system futt, user cannot find anyone to bump 
load control group at absolute maximum 

load control group In sat not in mot 


system not full, grouo full, 


no secondary 


system full, group full, cannot bump 


programming error In fg ct!t_ 
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Qoeratian: change person‘’s mailing name 


Conmand: chname 


Usage: This function calls the “change” function to change 
a nerson's mailing name. This function is used to change just 
the name for a singte voerson. It does not instaltf the PNT? to do 
this, use “install PNT.ont’” or do a reqular change and answer 
yese The full name must be enctosed In quotes. If the name 
argument is not aiven, the old name will be displayed, and a 
change accepted. 


Example: The name must be enclosed In quotes. To chanae the 
maltina name for the person-id “Jones”, tyoe 


u) chname Jones “"Jones,sW. Alfred” 
Ss) r 1557 12.558 &04+34 
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Qperatign? change person's vassword 

Command? choass 

Usage? This function calls the “change™ function to 


change a nerson’s password. This function is used to change the 
oassword for a single oerson. It does not install the PNT? to do 
this, elthker tyne “install PNTeont’ or do some other change and 
answer yese This function can also be used to verify a pverson’s 
oasswor 4. Answer “vyv" or “verlfy™ to the first auestlon, and the 
orogram will ask for a oassword. If the nassword you glve 
matches the person*s password, the command wll! type “ok™. 
Otherwise, the command will type “wrong” and ask If you want to 
change (for try again to verify) the password. 


Tf the user has changed his own nassword, with the 
"“e-chang2_password”™ argument to foginy this change wilt! not be 
effective. A special tool is avallable to unrestricted system 
administrators to force the change of such a password?’ this 
oroggram is catted “pass_uTtil™. 


Example: To change the password for the cerson-Id “Jones”, 


u) choass Jones 

s) Change password? 

u) yes 

s) Passwords 

ud) newpass (the orinter Is turned off) 
s) r 1557 12,558 40434 
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Operation’ change person’s programmer number 

Command? chprog 

Usaqe?: This function calls the “change™ function to change 
a poerson*s orogrammer number. This function is used to change 
Just the programmer number for a single person. It does not 
install the PNT? to do this, elther tyoe “Install PNT.ont™ or do 
a regutar change and answer yes. The orogrammer number must be 
all numeric. Tt may be up to 8 characters tong. Some 
installations use the “man number” assigned by the company In 
this field. If the programmer number Is not supotled, the ofd 


value will be disptayed and a change will be accepted. 


Examole?’ To chage the programmer number for the oerson-Id 
“Smith, type 


u) chorog Smith 7399 
s) r 1557 12.558 4&0+34 
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Operation? create user directory 


Commands cu 
Usage? This function is used to create a user‘s home 
directory. Home directories are created when the user first togs 
Ine and the “uopmf™ function calis this functlon, but In rare 
cases, it may be necessary to execute this function sevarately. 


Example: To create the home directory for “Jones.Gamma", type 


u) cu Jones Gamma 
Ss) r 1557 12.558 4&Ot34 
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Oneratign: orint daily billing output 

Command: day, dayok 

Us3ae? Every night, a selferescheduling absentee Job called 
the “crank™ runs which does the daily charging of users and 


checks for users who should be cut off. 


The “day” command prints the output from the crank on the 
console, and asks whether or not to delete the outout. The 
“dayok”™ command Just asks whether to delete the output. Uniess 
there was an error, the absentee outout seament should be 
deleted. 


Examole? The output from the crank shoutd look like this? 


s) Absentee user Accountant.SysAdmin togged In cae 
Ss) r 0330 12.558 40+34 


s) lLoacur - 731 cards, 20 charged, 708 oreviously collected, 
3 next perlod. 

s) Total charge: 345.67 

$s) Begin charging for 7/31/71 2355.0 to 8/9/71 2345.1 

s) cut 3, warned 7, total charge $45678. 90 

s) r 1557 12.558 4&04+34 

Ss) 

s) Absentee user Accountant.SysAdmin logged out ee. 

s) Delete? 

u) yes 


See section 5.3 (page 63) for a comolete explanation of the dally 
orocessIiIng. 
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Qeeration:? give project to project administrator 


command’ delegate 

Usage: This function Is used to give a project 
administrator control over a oroject’s omf. Once this Is done, 
the orosject may add and detete its own users, and set 


resource-usage limits on users in the project. 


The command moves the oroject*s opmf from “omf.archive™ to a 
soecified directory (keeoling a spare copy in 
“delegated_pmf.archive™), edits the smf to show that the project 
administrator may install popdt'*s for this oroject, and sets access 
on “pro}_admin_seg”™ and “>system_control_dir>update” so that the 
administrator may Install his odf. 


A delegated project is under control of the project administrator 
ONY. The system administrator will receive an error message If 
he attenots to execute the “domf™, “uomf™", or “omf™ functions on 
a deleaated project. Use the “undelegate” command If you wish to 
take a oroject back from a project administrator, elther In order 
to hav2 it controtied by the system administrators again, or so 
that it may be delegated to some new user. 


Example: To alve “Jones.Gamma™ control of project “8Seta™, 
olacing the omf in “>udd>Beta™, type 


u) delegate Beta rmudd>Reta Jones.Gamma 

s) archive? Beta appended to deltegated_pmf.archive 
s) $ do a “new_smf™ 

Ss) r 1557 12.558 40+34 
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Qperatiagn: write disk usage report 
Command: disk report, droy disk_auto 


Usage? This function is used to calcujate a disk usage 
report, The administrator may tyoe “disk_report™ to cause a 
manual disk usage catculation. Normally, though, disk usage Is 
done automaticalty every night by the absentee Job “dodro™s, which 
executes the “disk_auto™ function. (See chapter 5 for details on 
how the absentee use is managed.) 


The program “sweep” is used to get quota for all directories Into 


the data segment “disk stat”. The program “charge_disk™ then 
charges these usage figures to orojects in their “projfilte™ 
entries. A printable segment; called “diskreport", Is produced 


but not automatically orinted. To print copies of this segment, 
tyoe “rym diskreport”™. 


Examole? To run a disk report, type 


u) disk_report 

s) $ Creating disk usage repoort. 

s) $ Following figure is total quota/current use 

s) 75500/64432 

s) Charged 906 directories out of 910 fo 108 projects 
Ss) r 1557 12-558 40434 
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function deletes a user from a project master 


a project which is managed by the system administrators. 


from project “Gamma”, 


01/09/73 
Chaoter 3 
Oparation? remove user from oroject 
Command? domt 
Usaqe? This 
fite for 
Examotle: To delete user “S8lack"™ 
ud) domf Gamma Black 
s) r 1557 12.558 40+34 
s) Signal from System Control! 


process? 


tyoe 


PDT Instalted 
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Operation: delete project 
Command: doro} 


Usaqe? This function is used to delete a project. It edits 
the smf to remove the project entry, calls “eoro”™ and “erf"™ to 
set the date off for the project, moves the omf for the project 
to “oldomf.archive™ in case it is ever needed again, and calls 


detetedir to delete the ovoroject directory and all of its 
contents. 
Example: To delete project “Delta™, type 


u) doroj Delta 

s) archive: Delta added to oldomf.archive 

s) type 

s) type 

s) dd? do you want to delete the directory >udd>Delta?? 
u) yes 

$s) $ do a “new _smf” 

Ss) r 1557 12.558 & 9434 


Notes: If you answer “yes®™ to the question about deteting 
the directory, the project directory and all segments and 
directories inferior to the porojfect directory will be deleted. 
The project willl be charged for disk usage until the oroject 
directory is deteted. If you answer “no™, the project's 
directory and segments will not be deleted, and the project will 
continue to accumulate storage charges. Do not answer “no” 
untess there Is some exceptional reason for doling so, since the 
project directory will have to be deleted fater by an 
unrestricted system administrator. 
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install 
Qoeration? Install system table 
Command: Install 
Usage: This functlon is used to install a system table. It 


can be used when the table has already been converted, in case a 
oravlous installation request falled due to a crash. 


Example? To Install the current pnt, 


u) instal! PNT.ont 
Ss) r 1557 12.6558 4&0+34 


tyoe 


s) Siqnal from System Control process? PNT Installed 
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Operation: see If person is registered 


Command: ison 
Usage? This function types “true” or “false” denending on 


whether a noerson Is registered in the ont or not. It then tists 
afl users in the user registration file who have a last name 
which matches the argument. 


Example: To check whether the user “Jones™ Is registered, 
type 


u) ison Jones 

s) true 

s) Userid for “Jones, Herbert R.~“ Is “HJones”™ 
s) Userid for “Jones, Peter” is “Jones” 

s) Userid for “Jones, W. Alfred” is “AJones” 
s) Number of users with last name “Jones” Is 3 
s) r 1557 12-558 4043%& 
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OQneratlan? print mailing tabels 


Command? labels 

Usaqae This functlon prints a set of mailing tabels 
offline. 

Example? To run the labels, type 


u) tabels 
s) r 1557 12.558 &04+34 
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Operation? process charges and credits 


Command? misc 
Usage? This function Is used to Inout miscelfaneous charges 


and credits. For each transaction, the oroject ID, the amount 
(negative for accredit), and an explanation are required. Each 
transaction wil! result in a separate line on the monthly bill. 
The transactions are stored in “miscfile”, and the total Is also 
placed in “projfilte™. All three input items for a transaction 
may be out on the same tine, or they may be supplied one at a 
time. The program will indicate the tyoe of item to be Inout 
next. Typing “x”" instead of a project ID exits from this 
function. 


Example: ' To credit oroject “Aloha” for a crash, and charge 
oroject “Beta” for some manuals, tyoe 


ul mise 

s) proj 

u) Aloha 

s) amt 

u) -10.55 

s) explanation 

u) system crash 6/23 Jones 
$s) oro) 

u) Beta &.50 Manuals Smith 
s) pro} 

ud x 

Ss) r 1557 12.558 40434 
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Qperatian?: add new project 


Command: new_oroj 
Usage? this function is used to add a new project. 
Example: To add new project “Gamma", giving the user 


“Fooch.~Gamma™ oroject administrator status (1. e. write access on 
the project directory - the project Is not delegated), and 
setting an Initial quota of 100 records, type 


u) new_pro] Gamma Fooch.Gamma 100 
s) archivet Gamma anvended to omf.archive 


First, the system asks for the project titie. This field should 
be a short description of the puroose of the project. It may be 
uo to 52 characters tong. 


s) type type tittle 
u) Gamma Ray Research 


Next, the system asks for the name and address of the orincipal 
Investigator. This is the individual to whom the usage revort 
will be addressed. Both name and address may be up to 32 
characters long. 


s) Inv 

u) Prof. Qe Xs Jones 
s) inv_addr 

u) MIT 39-895 


Next, the system asks for the name, address, and fetephone of the 
project supervisor. This Is the Individual in direct contact 
with the oproject*s day-to-day activities. He may be the same 
person as the princinal investigator, or he may not. Often, he 
is registered as a user or project administrator for the project. 
The name and address may each be up to 32 characters tong. The 
telephone number may be up to 16 characters fonda. 


s) sup 

u) Mre Melvin Fooch 
s) sup_addr 

u) MIT 39-896 

$s) sup_odhone 

ud) MIT xi234 
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At this point, the system has finished adding the project to 
“orojfite™. You are now asked if you wish to review and correct 
the entry (by tyoling “o™ and then overhanps “c™) or if you wish to 
continue with the registration procedure (by typing “flite™). 


s) tyne 
ub file 


Now, the system adds an entry for the project to the requisition 
file, “reaqfile™, first asking for the external account number and 
requisition or purchase order number. 


s) type account 
ud) 11792 

s) reg 

u) 123656 


The system next asks for the cutoff limits for the project. The 
funds IJIimit is a dollar amount (enter "0" to show an “oven” 
amount). The date cutoff ftimit is a date, expressed as elther 
“mn/dd/yy" or “mmddyy”. If the project exceeds either of these 
limits, all users on the oroject will be prevented from  tlogqging 
in, buf the project wlll continue to Incur disk and registration 
charges until you delete the voroject. 


s) funds 
u) 0 

s) cutoff 
u) 7730/72 


Next, the system asks for the name and address to which charges 
incurred by the project should be reported. The name and address 
may each be up to 32 characters long. 


s) name 

u) Fiscal Office, Attn? L. Snottswood 
s) addr 

u) MIT 1-101 


At this point the project has been added to the requisition file. 
You area now asked whether you wish to review and edit the entry 
(by tyoing “p" and perhaos “c™) or If you wish to finish 


registering the project (by typing “fite™). 


s) tyre 
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u) file 


s) € do a “new _smf™ 
s) r 1557 12.558 40434 
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Operation? convert smf to sat and instait 


Command: new_smf 

Usage? This function is used after any change Is made to 
the smf. It converts the smf to as. binary sat, reruns 
“dailly_summary”™ to insert cutoff codes, and requests the 
initializer to instat! the new sat. Those functions which make 


changes to the smf will remind the administrator to doa 
“new_smf". Since this function Is time-consuming, it should be 
done at the end of a bunch of changes. 


Examole? 
ud new _smf 


s) r 1557 12.558 40+34 
s) Signal from System Contro! process? SAT Instaltted 
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Qoaration: Edit and convert omf, Install odt 
Command: pmf 


Usage? This function is used to do arbitrary editing of a 
omf. It throws the administrator Into the aedx editor after 
reading in the segment, and allows him to make any changes he 
warts. Recause aedx is comolicated to learn, this function is 
not for beginners. After the administrator exits from aqedx, fhe 
function converts the omf to a pdt, and signals the Initialtizer 
to install the omf. The function takes care of undating 
“omf.earchive™ as well. 


Example! To edit the segment “OSperator.pomf™, type 
ub omf Operator 
s) Edit. 
ud (editing commands) 
ud) ow 
u) aq 
s) r 1557 12.558 40434 
s) Sianal from System Control orocess! °DT Installed 
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Qoeration? month-to-date report 


Command? proj_mtd 
Usage? This command types a month-to-date report for any 
oroject*s usage, The report lists all users on the oroject and 


their dollar totals, as well as disk and miscellaneous charges. 


Example: To get a report of the usage for oproject “ALPHA™, 
type 


u) proj_mtd ALPHA 
s) Month to date for proj ALPHA 


s) Name logins charge 
s) White 11 $ 133.41 
s) Brown 0 $ 0.09 
s) 2 users 114 8 133.41 
s) registration $ 2.00 
s) misc $ 0.00 
s) disk $ 176.08 
s) Total $ 329.49 


s) r 1557 12.558 &0+34 
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Op2ration: gererate omf from pdt 

Command: recov 

Usage? This function is used If ae oproject*s PMF Is 
destroyed. The function generates a new PMF from the system's 


binary POT. 


Example: Suppose the project “Proj2”" foses Its omf. To get a 
new one, type 


ul recov Proj2 
Ss) r 1557 12.558 40434 
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Qo2eration? Register new person 
Command? register 


Usage? This: function is used to register a new person-id. 
Tt enters nim in the “urf™* and in the “opnt’. If a person is 
already a user of Multics, or If he was once registered and was 
not removed, this function should not be used since the user wll! 
still be in the urf and ont. 


Enter "“stop™ at any time to abort the orocessing of the current 
user, for Instance if you have misspelled his tast name, or if he 
is already registered. 


Example: To register a user, the dialogue goes tike this? 
u) register 
s) Enter full name (Last,First I.) 
ud Smith,Robert M.!:Prof. 
s) Enter mailing address 
u) MIT 39-575 
s) Enter programmer number or “none™ 
u) 6789 
s) Enter default oroject 
u) Lanquage 
s) Password? 
u) wugga {the orinter is turned off) 


The system will attemot to generate a unique person ID for the 
oerson being registered, by trying first his tast name alone, and 
then his tast name orefixed by his initials. Tf elther of these 
guesses succeeds, the system makes a tentative assignment = and 
asks if the person 10 is acceptable. If neither of the guesses 
succeeds, and If you reject the system*s guess, the system will 
ask you to specify a oerson IDs and will then check fo make sure 
that the ID is unique. 


s) Userld “Smith” Is already used by “Smith, Frank xX.” 
Ss) Trying “RMSmith™" for userid. 

s) Userid assigned Is “RMSmith™ 

s) Is this ok? 

u) no 

s) Please suggest a userid for “Smith, Robert M.™ 

u) RSmith 

s) Userid assigned is “RSmith” 
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ene eS en a 


a 


s) Is this ok? 
ul yes 


At this point, the user has been added to the user registration 
file and the PNT, You may .now add more users, or if you are 


finished registering users, you may Install the PNT Iimmediatety 
or later, 


s) More users to add? 

ul no 

s) Install now? 

u) yes 

s) Installing new ont. 

s) Installation completed, 

s) r 1557 12.2558 40434 

s) Stanal from System Control process? PNT installed 
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a eee 


rename_proj 


le ee Tce ON Lan 


Operation? rename project 


Command: rename_pro} 
Usage? This command is used to rename a project. 
Examote? To rename project “AAA™ to “BBR”, type. 


u) rename_oroj AAA BBB 

s} Now do a *new_smf* and then a ‘*pmf 8BR8* 

s) also change default project for users:.on 8BB 
s) r 1557 12.558 40+34 


u) new _smf 
s) r 1557 12.558 40+34 
s) Signal from System Control Process? SAT Iinstaited 


ud omf BBR 

s) Edit. 

u) 9a 

Ss) r 1557 12.558 40434 

s) Signal from System Control Process! PDT instaltted 
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Oe SEATED AE ED oie ED RE 


Op2ratian? request statistics to be printed 


Command? rqm 
Usage? This function requests the dprinting of a report for 
all administrators. The single argument is the name of a segment 


to be dorinted. 


Examples To sernd a copy of the disk usace reoort to all 
administrators, type 


u) ram diskreport 
s) r 1557 12.558 40434 
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setcrank, setdisk 

Operation? Schedule absentee Jobs 

Commands? 3.34 setcrank, setdisk 

Usage: These commands do the initial scheduling of fhe 


absentee jobs described in chaoter 5 (loage 62) which perform 
daily accounting. Untiess the absentee jobs crashed or the 
absente2a job queues were tost, there is no need to execute these 
commandse to check whether a Job is scheduled, fype 


lar -aqueue 1 -long 


If the jobs “dodro”™ or “crank” are not scheduled, execute 
“setcrank”™ or “setdisk™ as aporopriate. 
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undelegate 


Qoeratian? Undelegate a project 
Command? undeleagate 


Usage? Execute this command if you have delegate a project 
to some user, and wish to regain contro! of If or delegate it to 
some other usere 


Ccxamolet To chanae the oroject “BLAH” from contro! by 
Smith.8LAH to control by Jones.BLAH, tyne 


ud) undelegate BLAH 

s) archive: BLAH appended to omf.archive 
s) $8 do a new _smf | 

s) r 1557 12.558 40+34 


u) delegate BLAH >udd>BLAH>Jones Jones.8S8LAH 

s) archive? BLAH annended to delegated_omf.archive 
s) &E% do a *new_smf* 

s) r 1557 12.558 40434 


u) new _smf 
s) r 1557 12.558 &O04+34 
s) Sianal from System Controft Process: SAT instaited 
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Operatian? add user to oroject 
Commands: uomf 


Usage? This function adds a user to a oroject. [It Is used 
oniy on projects which are not delegated. The function extracts 
the oroject*s omf from “omf.archive™, edits the pmf to add the 
nen entry, converts the omf to a odt, signals the Initlalizer fo 
instal! the pdt, and replaces the edited pmf in “pmf.archive™. 


Example: To add user “Jones” to project “Gamma, type. 
u) uomf Gamma Jones 


Ss) r 1557 12.558 40434 
s) Signal from System Control process: PDT installed 
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Other commands 
other commands 


eoro, erf, mail, nelo, logout, status, 
fistacl, ltistcacl, tar, cary mq, ga 


Consult the MPM and the MPM SPS for detallis on the 


us3qge of these commands. A short exotanation of each follows. 


car 


enoro 


er f 


ga 


help 


lar 


listact 


listcac! 


logout 


nail 


cancel absentee requesf,. Use this function 
1f an absentee job is scheduled too many 
times by mistake, 


edit “porojflle’. Use this furction to change 
a nroject’s supervisor name, titie, etc. 


edit “regqfite™. Use this function to change 
a oroject’s account number, requisition 
number, funds, cutoff date, etc. 


getquota. Use this function to orint a 
directory’s disk quota and usage. 


print information on command usage. 


list absentee requests. Use this function 
(usualtty with the “-q 1% argument) to list 
your absentee requests. 


tist access control tlist. Use this function 
to check accessibility of a segment, 


list common access control fiste Use this 
functlon to check accessibllity of the 
cantents of a directory. 


fog out from Multics. 


read or send mail. To read mall sent to you, 
tyne 

mail 
To send mail to some other user, type 

maii * Person Project 
and then Type your message, ending with a 
line consisting only of "2%. 
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mee 


ae SE eee ear seme 


mq 


Status 


rev 3 


Administrator Commands 


movequota. Use this function to shift quota 
to a directory from its superlor. 


orint information about a segment. Use this 
function to see when a segment was created. 
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The following is a short explanation of the monthly billing 
process and the Information used in monthiy ollting. 


The most imoortant thing to remember Is that the monthly bilting 
process consists mostly of a orint pass over the saved PDT’s and 
a orint pass over “reqfile”*. Other Information Is atso taken 
from “orojfile™, “miscfile™, and “billing _footnote™”. No pricing 
out of usage is done during the billing process! this has alt 
been done durina the daily pvrocessing. 


&.ei Outout from billing 
The reoorts outout from the monthiy billing process are? 


1. tong_bili - this report is a complete breakdown and 
justification of charges for each oroject. For each 
project, the bill witt have from one to four sections? 


a) charge summary, by user 
b) Interactive usage, by user 
c) absentee usage, by user 
d) I/O daemon usages by user 


In addition, the charge summary shows the oroject’s 
disk and miscellaneous charges, lists the current 
orices, and may have a footnote intended as a message 
to all project supervisors. 


2e short_bill - this report consists of just the charge summaries 
from the tong obilt. The orices - and footnotes are 
suppressed, An elaborate grand total oage Is orinted. 
This report is intended for the use of system 
administrators and facility directors. who find the 
long bill too bulky. 


3. bill = this report is a sisting, by account number, of the 
charges made to each account. One line Is orlinted for 
each oroject, showing the charges this month and the 
charges to date, face amount, and requisition balance. 


&e msum - this report Is the monthly summary. It has one tine 
per requisition or ourchase order, and gives the same 
Information as in “b1II™. 


5. cards - at the MIT installation, this deck Is punched for 
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transmittal to the MIT General Accounting Office. The 
program “nunch_MIT_deck™ oroduces this segment. The 
peculiar format of the cards and the many ad ho¢ 
decisions in the code are the result of the accounting 
office*s requests. 


It is expected that other Instattations will remove alt 
mention of this proaram, lf they don*t need any 
external record of charges, or that they wltl insert 
some  tocal program which may or may not produce cards 
in piace of “punch_MIT_deck™. 


6. miscseorint - this is a listing of all miscellaneous charaes 
and credits for the month. 


Re dback - this revoort Is the result of an absentee Job 
fabricated by the blilting process and run tater. It 
lists every daemon session during the month in 
chronological order, and shows, for each session, who 
used the daemon, how much he used, and what shift and 
queue he used. 


9. syst2am_month.report - this seqment gives a summary of Multics 
usage for the billing neriliod. 


10. diskreport - this report shows each project*s disk usage for 
the month. It also has a map of every directory In the 
Hierarchy which has a disk quota, givirg its current 
usage, Its charge for the month, and its quota. 


11. consoleerenort - this revoort shows the usage of each 
terminal, sorted by terminal ID. For each user who 
used a given terminal, the total connedt time during 
the month and the number of logins Is shown. 


&.2 Inouts to biiting 


The inout segments to the biltiting process and what of their 
contents is used are tisted below, 


1. PNT*'s - the cooled odt segments in 
>udd>SysAdnin>-admin>safe_pdts contain the complete 
usage data for each user for the biltfing nerlod. 


26 projfile - this seqment is used mostiy to aqet the disk usanse 
figures, which are stored there when a disk report is 
rune The project titte and the name and address of the 
project supervisor are also used to create headings on 
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3. 


8. 


the long and short bills. 


reqfile - this segment has the charges which are actually 
bilted. Daily processing has updated “reqflle™ from 
the figures in the PDT°s, so the two shouid agree. (An 
error comment is printed If they do not, and the 
“regqfile”™ values are used.) The name and address of 
the person in charge of the accourf as well as 
requisition numbers, amounts, and cutoff dates are also 
extracted from this segment. 


miscfile - this segment is the Journal for miscellaneous 
charges and credits associated with a project. On both 
the short and tong bills, al! entries for a oarticular 
project are focated In this segment end re-printed. 
(If the total of charges and credits in “porojfile™ does 
not match the total from adding the individual entries 
in “miscfilte™, an error comment will be printed and the 
total from “"miscflie” actually bliled.) 


billing _footnote - this segment is optional. Sf oresent, all 
the text in It wilt be orinted at the bottom of each 
project*s usage summary. This segment can be used to 
announce forthcoming orice changes, or make other 
announcements to the administrators for each oroject. 
It is orinted on the tong bli! onty. 


disk_stat - this segment is used in the preparation of the 
disk report. 


today.use_totais - this segment is used In the preparation of 
system_month.report. 


The accounting segments saved In the subdirectory “h"™ are also 
used in the preparation of “dback™. 
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4.3 Steos in billing 


The orrcedure for oreparing a bill consists of three parts? 
orenaration, actual running-off of the outout, and cleanup 
operations once the b1I!l Is Judged correct. 


Tha oreparation ohase consists of checking for any un-orocessed 
dormant accounting segments, and checking to see that a disk 
renortf has been run recently. 


bill orepare 


does most of this. The administrator should also make sure that 
the segment “bilting_footnote”™ is up-to-date, and that all 
miscellaneous charges are Inout. The administrator may run a set 
of malting ltabels at this time. 


Tha actual running of the bill is initiated by typing 
bill run MM DD YY BXXXX*X 


where MM/DD/YY is the date of the tast day of the month. The 
arqjument BXXXXxX is used by “punch_MIT_deck™ - other Installations 
will orobably rentace this argument with others more apovrooriate 
to their needs. 


The “run” orocessing orenares all of the above renorts and bliiis. 
It dorints one copy of the biltis In the highest aueue before 
startiny on the usage summary reoort. 


As soon as the administrator has examined his copy of the bill 
anid found no aross errors, he may type 


bil! accent MONTH 
which causes the following’ 


Le Jorinting of many copies of the billing outnut and revoorts. 
The addresses for these reports are obtained from 
“value_seq™,. This dorinting Is done by the “rabiiti’ 
function. 


ae Submission of absentee Jobs to create the outpnut reports 
“console.report™ and “dback™. 


36 Copying of the segments used to create the bit! Into the 
directory HF. The names of these segments are orefixed by 
the MONTH snecifiled as an argument -- for examnote, “reafiie” 
is copled Into “HF>MONTH. reafile™,. 


Multics System Administrator's Manual Page 451 


01/09/73 . rev 3 
Chapter 4 Rilfting 
h, Resetting of the varlous data bases for the next month. The 


program “reset_usage™” Is run to subtract the user usage 
figures in the copled odt*s In >udd>SysAdmin>adminosafe_pdts 


from the usage figures in the odt*s In 
>system_control_dir>nodt, so that the month-to-date usage 
totals willl start over for a new month. The program 


"uo_ctr™ is also run, to add the “charges this month” field 
in *"reafile™ Into the “charges this requisition”, and reset 
tha “charges this month”. Any entries ir “reafite™ or 
“orojfile™ which are marked as having been deleted during 
the month are then deleted. 


De Resetting of the disk meters in the directory branches. The 
program “reset_disk_meters™ is used to subfract the value of 
the time-nage-oroduct integrator used for charging (stored 
in “disk_stat™) from the vatue in the branch. 


Once the blitis have been mailed out, and everybody who should 
have a copy has got one, the administrator should delete the 
biltis from the disk by tyoing 


bill delete 


The amount of storage required by the bills wit! vary, of course, 
denending on the number of users registered on the system, and 
the number of sessions used during the month. It may come to 
several thousand disk records. Be sure to have enough quota 
before starting the bilting run. . 
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Tne daily billing and statistics are produced through the agency 
of two absentee Jobs which run every night, and which re-schedule 
themselves to run again the next night. The first Job is the 
disk storage accounting. The second Is the actual 
accounting-segment undate run. Both Jobs oroduce reports which 
are dorinted for the system administrator.: 


5.1 Use of Absentee 
The disk accounting job is controlled by the command seament 


dodrpo.absin 


This Job executes only one commands namely “disk_auto™ and = then 
fogs out. 


The accountina-segment update run is controlied by the command 
segment 


crank.absin 


which also executes only one command, namely “crank”, and then 
logs out. 


Fach job reschedules itself in queue 1 for the next night, by 
executing the “enter_abs_request™ command to re-submlt the job. 
Tha tine at which the job Is scheduled is kert In value_segq, 
under the variable names “crank_time’™ and “disk_time”. The disk 
reoort should run before the crank, in order to charge the most 
up-to-date disk figure to the users. 


The disk report Job is restartable, so that lf the system crashes 
during its run, if wll! be rerun, 


The crank job cannot be restartable. If the system crashes and 
segments are reloaded, users might be doublte-charged or not 


charged at all for some usage. (See chapter 10, “Crash 
Recovery”, for more Information.) Therefore, the crank job Is 
marked not restartable, and furthermore the variable 


“abort_crank” in value_seg is used to stoo the crank from running 
again, if it crashes. When the crank is about to enter Its 
critical region, it sets “abort_crank™ to “true”. When it oasses 
the critical region, -it sets “abort crank” to “false”. (Some 
parts of the job, those deating with summaries and so forth, need 
Not be orotected.) When the crank first starts uns It checks 
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“abort_crank™, and if it is “true it Immediately fogs out. 


5.22 O1s*« reporting run 


See the writeuo of “disk_auto”™ for details on what is done by the 
disk reoorting run. The important result of a disk reporting job, 
from the roint of view of charging, is the storing of current 
disk usage figures in the seqment “projfite™. These figures will 
be oicked un by the accounting unodate job later and used to 
charge the project for disk usage. 


5.3 Oaily accounting run (crank) 


The "crank" Job executes a command of the same name in master.ec. 
This command performs the folltwoing steps! 


1. reschedule the crank for tomorrow 


Ce process all Io daemon records in 
>system_control_dir>I0__accountina which have not yet been 
processed and which have been completed. Call 


charge_daemon_usage to add this usage the the aponrooriage 
PONT entries in >system_control_dir>r-podt. 


Ss make a backup copy of the answering service version of 
the ont. 


4e call odt_cony to cooy all system pdt*s into safe_odts 


5. run “comoute_bili™ to charge user usage, from the odft*ss 
to the aopvrooriate entries In reafite. 


6. run “dally _summary”" to write areport giving account 
status and to modify the sat to cut off orojects which are 
out of funds. 


7. Install the new sat. 


8B. run “daity_log_orocess” to oprenare tog extracts for 
System proarammers and administrators. 


9. run “copy_as_meters™, “orint_meters", “system_total™, 
“usage_total", and “system_dalily_report™ to prepare a system 
statistical report. 


if. dorint covies of the ouput renoortfs. 


a check for the existence in >system_cortrol_dir of any 
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data segments which need orocessinga. TO__accounting fites 
and togs are oprocessed automatically. Answering service 


dumps are automaticattly orinted. 


The Job sends a message to the system administrator reporting 
successful completion via the “send_message™” command when It is 
al! done. 


524% Dally operation 


Every day, first thing in the morning, the system administrator 
should read the output from the crank. If it has not been 
dorinted because of a system failure, or because the output is 
fost, the administrator should log In and type “day™ (see the 
write-uo of “day™ in chaoter 3, page 32) to see the output. If 
everything ran correctly, the administrator merely repiles “yes 
to the “Delete?” question and logs out. If the output has been 
dorinted successfully, the administrator can avoid having It 
tyoed again on the console by executing “dayok”™ instead. 
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New_pro] is the tool! for adding a new project. You will want to 
know thea following: 

Suoervisor 

User fist (must nave at feast one user) 

account, requisition numbers 

funds 

termination date. 

bilting address 

delegated? If sos what user id and what directory 

initiai quota 
The project ID can be the same as a person ID If you want. 
Projects which have been deleted and then return are a problem: 
try to avoid this. 
The sequence for adding a new project ist 

1. new_oro)] (see page 4&1) 

2. new_smf (see nage 44) 

3. register any new persons (see page 48) 


be use “upmf™ to add each oerson to the nroject (see nage 
54) 


5. delegate the project If requested (see paae 33) 


You may batch several projects in step 1, of course, and do many 
registrations in step 3. 
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To add aeuser to an existing project, you use the tool “uomf™, 
(see pajge 54.) If the user Is not already registered, uomf will 
tyne a warning message. If you get this message, register the 
user with “register”. {see page 48.) 


To delete a user from a oroject, use the tool “domf™. (see page 
35.) The user will remain registered as a person, and his 
address and oassword willl remain In the system. If the user Is 
leaving the Installation, and is not expected to return, you 
should not remove him from the urf and pnt immediately, since his 
name may be on some access contro! tists. For instance, lf the 
person named “Jones™ quits the company, it woutd be unwise to 
remove the name “Jones” from the user registration file riaqht 


away? sunppose someone else named Jones arrived the next day. 
When he was added to the system, he would have access to some 
segments which he should not have, The unrestricted system 


adninistrator’s tool “remove_user™ can be used to compoletely 
remove a user from the PNT and user registration file. 
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This section deals with making and keeving the system secure. A 
system may be run foosely or tightly, but some security Is 
necessary even if the installation does not care if resources are 
mis-appropriated. Securify measures not only frustrate immature 
individuals, they orovide insurance that accidents wil! not 
destroy the system, and orovide information about what hapovened 
when something went wrong. 


8.1 oasswords 


Each registered Multics user has aepersonal password. This 
oassword is his personal oproverty, and is assecciated with the 
person, not the user identity (combination of person and 
project). Project administrators need not know the oasswords 
associated with the persons working on their project, although 
since the project administrator usually assists In getting a new 
user registered, he may know it. 


Passwords are stored in scrambled form internaitty within the 
system. Once a user‘s password Is entered (via the “register” or 
“"change™ commands) it is not stored in readable form anywhere in 
the system-administration data bases. When the user attemots to 
log in, the password he types is subjected to the same scrambling 
transformation, and the scrambted values are compared. This 
procedure makes it fairty difficult for a user to obtain another 
user’s password, even if he is given access to the ont by 
mistake. 


The password mechanism is the strongest orotection feature In 
Multics? if users cannot be uniquely identified, then different 
access control rights cannot be oranted. Users should be 
encouraged to keep thelr oasswords orivate, and to change them 
often. Sensitive oasswords, in oarticular, should be changed 
regularly. 


Users may now change their own passwords dynamically, by use of 
the "“-change_pvassword” argument to togin. They should be 
encouraged to do so often. Once a user has changed his oassword 
by use af this togin ootion, subsequent installations of the PNT 
will) not reset the password. The “chpass™ administrator command 
will) continue to work though, since it uses the program 
“nass_util™ to modify >system_control_dir>ont directty. 


The answering service keeps various counters in the PNT reaarding 
the use of a password, In oarticular, the system counts 
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incorrect passwords, and can type a message to a user at togin 
informing him how many times his rassword thas been given 
incorrectiy since its last correct use. This feature may alert a 
user that someone has tried to guess his password. 


&.? Access control 


Access control is the system's second major tine of defense. 
Consult MPM sections 1.2.6 and I1I.3 for an explanation of the 
mechanism. Properly set, the access control! mechanism can make 
the system very secure, at the cost of some inconvenlence. 


Access contro! works only If user identities are held secure. 
This Is the reason that person Identifiers are assilaqned onty by 
the system administrator: otherwise, a clever project 
administrator could register an Identity which corresponded to 
some name already on an access control tist somewhere in the 
system, and so be able to tog in and use this access contro! tist 
entry for a purpose not foreseen by the creator of the ACL entry. 


The general prirclole to anoly is that no user should have write 
access to any system data base untess there i¢ a good reason, 
Those fows trustworthy individuals who may modify system data 
bases should be impressed with the fact that they should not use 
the privilteoe casually. It is a good idea to run an absentee job 
occaslonally which spoot-checks the access control tists on system 
segments to make sure that something has not been left 
unprotected inadvertently. 


Tha question of read access is tess clear. It is nossible to 
prevent users from reading anything except their own directories 
ana thelr contentss or one can teave most of the system readable. 
Two soecific cases are interesting: the cholce between “e *.*.*" 
and “ra *,*.*" on the CACL of >user_dir_dir makes the difference 
between users being able to tell who is registered on another 
oroject or not. The access control fist on 
>system_control_dir>answer_table makes the difference between one 
logaed-in user being able to determine another user’s process Id 
without oermission and not. 


Currentty, the system Is sltightty deficient In that the SysDaemon 
ant SvsAdmin users have far too much oower. Someday, we will 
change the system to lock the daemons Into subsystems which 
cannot execute any but carefullty-checked commands, and we will 
remove nost global access rights, either getting along without 
them or accomplishing them In tower rings with iots of checking. 
As the system stands now, disctosure of a SysDaemon or SysAdmin 
oassword onens the system up comoletely. In the future, It would 
be nice to have the system secured to the point where no mator 
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breach of the system’s segment security could he accomnolished 
without entering the machine room. 

8.3 Telephone fine security 

Taooing a ohone is very easy. If sensitive data, such as 
passwords, are transmitted by phone, the system is no more secure 


than the telephone connection box. An instaltation which thinks | 
it is worth the trouble to protect against this sort of potential 


oroblen could consider dedicating GIOC channels to 
special-purpose uses such as daemons and administrative 
operatlonse The privileged users could then fave start_up.ec 


segments which logged out if they were not invoked from the 
proper channel. Consoles on these dedicated channels could be 
hard-wired If close enough to the GIOC (there are other good 
reasons to do this) or could be connected over dedicated 
telephone tines, perhaps even with a pair of the “scrambler™ data 
sets which are available commercially. 


8.4% Terminal ID codes 


If the terminals used on the system Identify themselves with = an 
I0 code, it is often easy to track down what terminal was 
involved In a security breach. We are considering a method of 
restricting use of the system by using terminal ID codes, as an 
optional feature. Since these ID codes can always be faked, one 
cannot rely on this feature atone. But if terminal ID is free on 
a terminal you are considering, definitely get It. The orogram 
“console_report™ is used to produce a listing of 2e!! terminals by 
ID code, with the tist of users who used the terminal during the 
month. 


8.5 Use of the log segment 


The program “daily_log_orocess™ can be used to monitor system 
operation by setting uo its tog _selfect_file to watch for 
conditions of interest. The version orovided with the system 
will create a full fog of all events, a tog of all “interesting” 
events for system programming, and special togs for absentee 
oroblems and network oroblems. This seqment can be edited as 
necessary to monitor specific individuats, or specific terminats. 


8.5 Cross-checking In the bIIling orocess 


It is very hard for any user to get away with using Multics 
resources without leaving some traces, Even if someone’ gets 
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loqgaed in on a iesystem administrator identitys and attemnts fo 
fudae tne accounting records to conceal the fact that he logged 
Irs most usage Is recorded in more than one nlacee Uniess the 
thief figures out how to ovatch ali of the usage datas some 
accounting program will oroduce a “discrenpancy™ comment. 


8.7 Macnine-room security 


Lt is Not always necessary to run the facility like Fort Knox in 
order to decrease the chances for security breach substantlally. 
Tf the general orinciote of hnaving only onverators or accompanied 
visitors is established, If outout Is <Alstributed outside the 
conouter room and users are not atltlowed to hang over the 
operatians consoles, and if users are not allowed to mess with 
the machine when it Is down, most possibitities for orobtems witl 
be elininated. 


8.3 Tano2 security 


If users can walk off with dump tapes, or mount them for 
themselves, the storage system is not at all secure. Work Is 
currently goirg on concerning the design of high-quality 
detachable media secuity measures. 


8.9 What fo to after a breach. 


Once the administrator finds out that someone has used a password 
he shouldn't have been able to, what does he do? Partiy, the 
answer depends on what kind of oroblem has occurred. Clearly, 
alft sensitive passwords should be changed simultaneously. Date 
andi tine modified of all segments should be checked, to see what 
has bean changed. Prints of the logs and accounting segments 
should be made and cross-checked. Consider a comrlete reload. 


B.10 Password trap 


The answering service malntains a “trao™ flag In the PNT, In each 
user antrye By using the program “pass_util™, a system 
adninistrator can cause this flag to be set one Whenever the 
person toaqs Ins a message will be typed on the initializer and 
filed in the loa, remarking that the password has been used. No 
intication that this has haonened is given to the user. This 
feature can be used when you suspect that a certain password has 
be2n comoromised and you wish to catch the fellow red-handed. 
Since tye terminal ID and channel number are tyred In the 
MESSAT2»s it is often easy to locate the user. There is another 
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flag which may be set, which “tocks™ the password, without 
changing it. {As a matter of fact, the user may even change his 
password white it Is tocked.) The user will be unable to !og in 
if nis password has been locked. 


The incorrect scassword counter mentioned In section 8.1, and the 
identification of the terminal from which the last bad password 
was issued, are also stored in the PNT. 


The system administrator may also choose to set an entry in fhe 
system message table to cause a user to receive a “biast™ message 
whenever he is flogged In and someone attemots to tog in with the 
Same name, project, and password. This feature may alert the 
user to the fact that his password has been comnromiseds It tis 
also useful in some cases of network use, since a user may log In 
from a remote host which then goes down without informing Multics 
-- if the user then attempts to ftoq in vla some other network 
route, the blast message sent to the first instance of the user 
will cause him to be logged out. ; 
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Disk storage accounting is done by a seff-rescheduling absentee 
Job, as described in chapter 5. A byproduct of this process Is a 
list of ali orojects which are ftow on disk. The administrator 
responsible for disk should attemot to give enough disk fo al! 
orojects to allow them to keep operating. If prices are set 
correctly, this will always be orofitable untii the time comes to 
exoand the building housing the computer. 


If sufficient quota is avalable on >udd to satisfy a projects 
need, all the administrator needs to do is to tyoe 


movequota >udd>Pro]} INCR 
to increase the storage available to Pro] by INCR records. 
To generate more quota on the system, do a setquota on the root 
oniy either from the initializer console or via “sac”, and then 
move the quota down to >udd, as follows? . 

sac “sq > 30002 mq >udd 1000" 
suoposing that the root quota Is normally 20002. 
It is permissible to have more quota altocated than is ohysicaltly 
available. The acutal amount of overallocation depends on how 
fast the community uses up quota and how ctosely the disk quota 
is watched? thls can be determined only by experience. Caution In 
this process is recommended, because the system crashes if it 


runs out of spacee 


For more discussion on this polnt, see section 13.1 (page 86). 
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If the system crashes while running the crank, a flag will have 
been set which orevents the crank from running acain until the 
state of the accounting segments is determined. (This flag Is 
the variable “abort _crank”™ In value_seg.) The various programs 
in the crank have been planned so that they can be re-run without 
ill effect, whenever possible. The first thing to do Is to 
examine the absout file produced by the crank, to see what the 
crank was doing when it was Interrupted. Next, check the date 
and time modified on the segments in >system_controt_dir and the 
segments in >udd>SysAdmin>admin, and confer with operations to 
make sure that no files were backed up due to a retoad. 


Usualty, at this voint, it is possibile to use the editors to 
create an exec_com fite which consists of the remainder of the 
stens in the crank, and then to execute it on-tine. 


In some cases, data which was lost may be reaenerated? for 
instance, If “orojfiie™ is lost, you should retrieve a copy, use 
“eoro” to add any orojects which were added since the copy you 
have, and to edit any other entries which changeds and then 
re-run the disk report to recaiculate the oroject usage. It is 
difficult to provide ae fool-proof prescription for recovery, 
since what must be done depends on what segments were tost or 
damaged. If your investigations seem to show that all is welt, 
type 


value$set abort_crank false 
to allow the crank to run again. 


Do an “tar” to make sure the crank and disk reoort jobs are 
scheduled. If not, do a “setcrank” and/or “setdisk™,. 
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There are two situations of Interest concerning accounting setuno. 
The first concerns the startup of accounting at an Installation 
which has never had 3 Multics before -- this is calied = an 
“accounting cold start”. The second concerns the modifications 
necessary for an installation which receives a new distribution 
of Mulfics, with significant changes to the accounting package 
which may require the reformatting of segmerts, or other 
modifications, In order to continue to operate. 


11.1 Accounting cold start 
Accounting cold starts are supported by the exec_com segment 
acct_start_up.ec 


which is distributed as part of the system tibraries. In 
general, all that the tocal installation need do Is», on its first 
successful bootload, enter admin mode on the Initiatizer and type 


ec acct_start_up cold 


and then follow instructlons. 


11.2 Accounting warm start 


Although some work has been done on designing an accounting 
warmstart, the supplied procedures may have defects if you are 
upgrading more than one fevel of accounting system in a Jumn, or 
If you have made modifications to the supplied accounting 
procedures for support of local Installation features. It Is 
imoerative that you study and understand the contents. of 
acct_start_up.ec before executing them. Read both the cold and 
warm start sections. The warm start procedure is designed to 
uograde the accounting system from the oreviously-distributed 
level fo the new fevel? if it looks ltike it wll! work, you may 
tyse 


ec acct_starf_uo warm 


from the initiatizer console. As of this date, no general 
accounting-distribution orocedure has been develoned. This 
deficiency in the system will be corrected, module by module, as 
time permits. In tne meantime, the best thina to do is to read 
the exec_com and skin those steps which took tike they would 
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destroy datas 

Pay car2ful note to the header of the SAT which Is created by the 
coldstart. If your SAT header does not f!ook like this, you may 
need to change the default attributes. 


It is a good idea to at the very feast reconvert the SAT, via 


“new _smf, and reinstall it. Tt cannot hurt to recompile all 
PNT*s and reinstall them Too. Delegated projects may be a 
oroblem here, Tf the format or contents of the PDT changes in 


such away that this steno is absolutely necessary, a conversion 
oroaran will be suoollied,. 


Examine the segments created by the coldstart. Tf you don*t have 
any of them, execute that section of the coldstart which creates 
tham, 


Tha seanent bound_admin_old_ contalins programs which used to be 
nart of the system administration subsystem, but which have been 
obsoleted, The programs In this bound segment are sometimes used 
for conversion from one tevelt of the accounting system to the 
next. 


11.3 Local Installation oarameters 

Most Instattiation oarameters used In the operation of the 
administrative system are kept in the segment 
“Instaltlation_noarms™. The standard accounting coild-start 
exec_con segment sets these parameters to the MIT values, In most 
casese A discussion of each voarameter fotlows. 


11.3.1 Shifts 


System usage may be divided into uo to eight shifts, numbered 
from 0 to 7. These shifts may begin at any half-hour during a 


weaks the current shift is the same for everyone, and the shift 
is the same at the same hour during every week, There Is 
currently No provision for over-riding the regular shift 


mechanism to account for holidays. Shifts are set by fliling in 
a tabte which contains 336 entries, one for each half-hour in the 
week, wlth a digit from 0 to 7.2 At MIT, we use only shifts 1, 2, 
3 and 4&4, and the hours are? 


shift 1 0800-1800 weekdays 
shift 2 1800-2400 weekdays 
shift =z 0000-0800 every day 
shift 4&4 0890-2400 weekends 
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11.3.2 Shift orices 


Prices may be set for CPU time, connect time, orocess time, core 


usage, and device usage on a per-shift basis. The current 
mechanism does not actually generate any charges for any but CPU 
and connect time. Later versions will distinaulsh between 


connect time and orocess hours, to allow multiote orocesses oer 
user and multipie terminais oer users we wilt also implement core 
chargin3 and device channel usage charging. Any installation 
Mav, of course, set the orlices for some resources to zero and use 
other administrative means to control resource usage. 


The calculation of the proper price for the use of a resource has 
been the subject of endiess argument. Every local installation 


will have Its own special way of computing these rates. The 
method we have evolved at MIT is the follonwinat first, we list 
all costs involved in running the service. This Iinctudes 


programmer and operator saiaries, cards and paper, hardware 
rental, and modems. (Desired orofit or planned toss could be 
inciludei -- we attemot to break even.) These costs are then 
attributed to cost pools, one for each resource which is 
chargeable. Resources which cannot be attributed to the cost of 
providing a particular service, such as operator salaries or the 
motor generator, are lumped in the category “overhead.” and the 
cost of this poo! is spread oroportionally over the others. Fach 
pool*s cost is then dlvided by estimated oayino-customer usage, 
to obtain a “break-even price." These figures are then fudged to 
make reasonable prices. If an estimate is uncertain, we round up 
Strongly. For shift differentials, we use the following table? 


shift 1 115% of break-even 
shift 2 90% 
shift 3 50% 

shift 4 80% 


We also usually round the shift prices uo to the nearest multiole 
of $.50 ner minute, just to make the prices easy to remember. 


The program “price” is available to interested system 
administrators from T. He. Van Vieck$ it mechanizes the oricing 
pnilosoohy discussed above. 


11.3.3 Instaltation ID and titles 


Instattation_oarms contains the 32-character installation 19 
field which is typed out when aeuser dlals up. This should 
contain both the company and department abbreviation, and the 
city ani state. For example, 
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MIT, Cambridge, Mass. 


The installation titles are lonaer character strinas, returned by 
the oro jram system_info_S$titless which are used at the too of 
each page of the montntiy bills and in many other reports. There 
are two strings, the company name and the department I). Both 
strings are entered twice, once singte-sraced and once 
double-spaced. For example, 


Massachusetts Institute of Technology 
Information Processing Center 


and 

Mass achus et Ff S&S eeces 
Locally-written administrative tools should, of course, use these 
titles so that they can he exnorted to other installations. 
11.3.4 Miscellaneous parameters 
The maximum time allowed for a ltogin time, the cycle time between 
initiatizer accounting updates, and the maximum inactive time 
before automatic logout for a normat user are all alven In 
seconds In installation_parms. The number of ftogin tries a user 
may have before the system hangs up on him is atso soecifled 


there. 


The usual values for fhese oarameters are? 


inactive_time 15-90 mins. 

warning _time 3-5 minse 

login_time 3-5 minse (more [If noisy tines) 
acct_uodate 10-60 mins. 

flogin_tries 1-4 


Thase values may be modified according to the needs of the 
Instaltation. The ranges given are reasonable limits, though. 
For examnie, the accounting update cycte should not be too small, 
or Initializer time will go way up, and it should not be too 
larqe unless the system hardly ever crashes, or revenue will fall 
off. Consult the SPS writeup of the ed_instaltation_oarms 
command for more information. 


11.3.5 Messages 


Installation_parms also contains the messages typed out on the 
yuser*s console if Als account Is out of fundss nearly out of 
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funds, oast its termination date, or nearly past its termination 
date. We out the teleonhone number of the User Accounts Office In 
these messages, to make sure the user knows who to call. 


11.3.5 Daemon and absentee rates : 


These rates are kept in instatiation_parms, in an item named 
"queue". Absentee CPU and real-time prices are stored by queue, 
as are [0 daemon rates ver 1000 tines. Queues one through four 
may have rates set. 


11.3.7 Absentee “timax” narameter | 


The scheduling oriority for a Multics orocess Is calculated by 
the schedufer by a comnolex algorithm which takes several factors 
into account. Consult the MPM SPS for the details of this 
calculation. For system-administration ourrnoses, what Is 
Imoortant is that each process, when it is created, is assigned a 
parameter called “timax™, which limits the depth to which. the 
orocess may sink in the scheduling queues. Interactive processes 
are assigned the default timax, which is currentfy 8000000 
microseconds. The timax value for absentee processes, however, 
is obtained from Installation uparms, and may be different for 
different queues. A ftarger number will allow a fower queue? = aft 
MIT, we set all queues to have a timax of 160000700. This means 
that absentee jobs sink rapidly fo the bottom of the queues, 
where they are given relatively tona CPU time limits, and that 
interactive users will always get better response than absentees. 
By setting the values associated with the item “timax™, an 
installation may experiment with other values for the absentee 
timax. 


11.3.8 Configuration Table 


A table Is keot in “Instaltlatlon_oarms” which describes each of 
the system configurations which an installation will use, by the 
number of CPUS, number of 64K memories, and shift. For each 
such entry, the table contains the vatue of the maximum number of 
foad units allowed on the system, the maximum number of absentee 
users allowed, the highest-numbered (lowest-oriority) absentee 
queue from which jobs will be run, and two response control 
parameters. Untess automatic adjustment of maxunits has been 
disabled (see the writeun of “admin” In the SPS, and the onerator 
command writeup of “maxu™), this table wil! be referenced to set 
maxunits whenever the system is brought up, whenever the shift 
changes, and whenver the system configuration changes. The 
configuration is looked up In the table, and maxunits and the 
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absentee maxima are changed. 


If resnonse control Is enabled, the system will attemnot to adjust 
maxunits on every login and togout,s so that the average queue 
length falls between the “low” and “high” values. Maxunits will 
be incr2ased whenever the average queue !tenath is below “tow™: it 
will b2 decreased whenever the queue tength is ahove “"hIigh"’S and 
It will be set to the current number of users whenever the queue 
lenath is between “low” and “high”. 


The order of the elements in the configuration tablfe Is 
Sitnificant. The etements should be in order by number of CPU'S, 
within that by number of memories, and within that by shift? 
smaller numbers first. The fookun will continue as long as anv 
table element is fess than the vatue being looked und, so that an 
element sepcifying 9 CPUs, 100 memories, and shift 8 will always 
Ston th2 ftookuo. This feature can be used ifs for Instances your 
installation does not wish to have different varareters depending 
on shifts instead of having eight table entries for each 
combination of CPU and memory for shifts 0-7, you may sunnoly only 
one entry, which has a shift number of 8&8. 


11.2% Runtime constants in value_seg 

The symdso0l-tabie seaqment value_seqg is usedy with the active 
functlo. value, to insert certain installation-varlable 
parametars into the operations conducted by the master exec _com. 
The most important of these values are 


crank_time the time of day that the crank runs 


disk_tine the time of day that the disk accounting 
runs (this should be before the crank) 


admin_addr address, in dprint header, of system 
administrator 


accts_addr address, in dprint header, of system 
accountant (user accourts office) 


directorX_addr addresses, in dorint header, of 
directors (currently, up to 7 may he 
named) 

abort crank “true” if crank Is to abort, else 


"faise” (see sectlon 5) 


sysa_addr address, in dorint header, of system 
assurance 
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sysorg_addr address, in dprint header, of system 
programmer 

admin_onltine person and project id of user to send 


“crank ran” message to 


fog_number current number of log segment being 
processed 


The critical vatues are set to reasonabie vatues by the 
accounting coldstart. they may be changed with the valuefset 
conmand. The command “value$dumo™ may be given to tyoe out al! 
vatues in value_seg. [f the various addresses in the dorint 
header are set to "skip", the “ram*® and “rabit!t*® commands wil! 
skin orinting of the corresvonding copoy of the file. 


11.5 Modifications to the exec _com seaqments 


Some installations may wish to bulld additional administrative 
tools and insert calis to them Into the conies of master.ec and 
biller.ac which are used by the focal system administrator. In 
oarticuliar, most installations wit! wish to remove the call to 
punch MIT_deck from the monthly billing and Insert something more 
aonoroortiate to thelr own needs. This Is easy to dow since the 
system-library copies of the exec-coms are copied into 
>udd>SysAdmin>!lib. It is a good Idea, though, to keep careful 
notes on what modifications were made to the segments and why, so 
that the changes can be made again after a new version of the 
accounting package is distributed with a new system version. 


11.6 Load control grouo table 


Consult chapter 14 (page 89) for information on the system 
parameters which contro! the foad control! facility. Note that 
setting up load control requires determining what groups are 
required and which orojects betong in each groun, and then 
decidin3 how much of the system maxunits each groun should be 
able to occuny. These decisions require some picture of fhe 
normal foad pattern of the system, as well as knowledge of the 
priorities attached by management to individual projects. 
Instattations which are just starting up shoutd probably belna 
with just two grouos, “System™” for the system users such as 
da2mon processes and other uses which are “part of the system", 
and “Other” for everybody else, If siqnificant system 
orogrammning work will be done on the system, a grouo for the 
system programmers -- those on the project “Multics™” -- may also 
be necessary. 
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11.7 System Message Table 


Answering services numbered 6.12 and higher make use of a special 
system facility to allow local installation replacement of all 


answerina-service produced messages to users, without 
modification to the code in bound_user_control!_. The unbound 
seyment as_error_table_ may be replaced by an Installation to 


tailor the messages tyned out by Multics to tocal installation 
requirements. 


The procedure for modifying a message is quite simple? a system 
orogrammer edits as_error_table_eet to modify the text of the 
messaqe, comoiltes the seaqment via error_table_compiter and alm, 
and instalis the new system nessage table. 


Several of the ertries in the message tabtfe are actually format 
strings for loa_. These items may be edited, but the 
data-transmission items In the format must, of course, remain in 
the same order. 


If the instatlation does not wish to have some of the messages 
typed by the system, it may choose to - make the text of the 
messages null in the table, For examole, to sunoress the “Last 
login wWaSeee™ message, the following line should replace the 
statement for “last_login_msg™ In as_error_tablie_.et? 


last_login_msg? liiwas,: 
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Several special! user identities are bullt into the organization 
of the Multics system, or are referred to by the documentation by 
name. This section describes the various special! identities and 
their oeculiarities. 


12.1 Full system administrators 


Full system administrators are users on the oroject “SysAdmin” 
who have the = normal! initial orocedure, “process_overseer_". 
Since they have potential write access on every segment in the 
System, and since they may access the highty-poriviteged gate 
"hohcs_“ and the orivileged gate “phcs_", they can cause great 


damage to the system by Inanpvroorlate execution of a command. 


12.2 Restricted system administrators 


Restricted system administrators are users on the project 
“SysAdmin” who have the special initial procedure, 
“accounts_overseer_™, This program altows them only a small set 
of innocuous commands, and the ability to execute any function 
contained In the segment “master.ec™. A great deal of 
self-checkinag Is built Into the command sequences contained In 
“master™, so that a non-programmer can be trained to operate as a 
restricted system administrator. 


12.3 I19.SysDaemon 


The I0 daemon has control of the printers, readers, and ounches 
on the system. Its initial procedure is “daemon_exec_“. The 
daemon is special in that it has write access on the daemon 
queues contained In 


>daemon_dir_dir>io_daemon_dir 


so that If may remove orocessed requests from the queuese The 19 
daemon does its accounting In the segment “TO__accounting™ in 
>systen_controlt_dir. Excepte when it is in the procedure 
“act_cti_" It has no access to segments In >system_control!l_dir, 
to prevent users from requesting prints of the password segment. 
The project “SysDaemon" and the user “TI0.SysDaemon™ have the 
“multin™ attribute flags so that the IN daemon can be tlogged in 
more than once, in order to run more than one printer. 
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12.4 Rackup.SysDaemon 


The RBackun daemon ooerates In ring 1» instead of ring &, so that 
{t may dumo all segments which are part of the hlerarchy. It 
comes un In ring 1 because the statement 


rings 1; 1°: 


has been added to its omf entry In “SysDaemon.omf", and because 
the smf gives permission to SysDaemon to have users log in tn 
lower rings because it has the statement 


ring? 1, a 


in the omf entry for the project “SysDaemon™. Its Initial 
orocedure is “nrocess_overseer_"“. This user has sneclal access 
riashts to at! directories on the system, throuch the medium of 
the SPACL. 


12.5 Dunper.SysOaemon 


The Dumoer daemon is used to perform complete dumps of the 
hierarchy. I[t is otherwlse Just tike Rackup. SysDaemon, 


12.6 Retriever.SysDaemon 


The Retriever SysODaemon is used to retrieve user segments from 
conplete or incremental dump tapes. It operates in ring tt, and 
Its initial orocedure is “process_overseer_"™. It Is on the 
SPACL. 


12.7 Translator.SysNaemon (obsolete) 


The Transtator daemon has been eliminateds now that absentee is a 
regular facility of Multics. It reoresented a potential security 
hote in the system, since It attemoted to write seaments In the 
user area, and could nave ended up writing segments which were 
accessable to *.SysDaemon but not to the user. 


12.8 Ring _1_ Renpair.SysNaemon 


This user comes up in “process_overseer_", but In ring 1. This 
is the only user who can execute any command from the console in 
rina 1. This identity is used to fix problems with access control 
in ring 1. The nassword for this user Is keot In ae sealed 
envelone in the anerations area. 
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12.9 Renoair.SysDaemon 


This user identity is orovided for evergency fixes by system 


programmers who need SysDaemon access privileges, The password 
for this user is kent in a sealed envelone In the onoeratinons 
are@ae 


12.10 Repair.SysAdmin 


This user identity is provided for emergency fixes by system 
orogrammers who need SysAdmin access priviteges. The vassword 
for this user Is keot In a seated envelove in the operations 
area. 


12.211 Network Daemon 


This user Is togged in to provide the functions associated with 
the Network Control! Process. Its “start_up.ec” segment brings uo 
the network, and then monitors the operation of the network. The 
orimary functions of this user are to assist in the  iInitlat! 
connection between foreign hosts and the system, and to perform 
segment-transfer operations. 


12.12 anonymous users 


Anonymous users are all given the access contro! ID “anonymous” 
instead of a person I0. Their usage is aggregated on the monthly 
bill and the statistics under the heading "Student Users”. The 
"who" command lists them as “anonymous”, and the “as_who™ command 
lists them with a star in front of the name. There is no reason 
why an anonymous user cannof be a project administrator. 


42.13 Fictitious persons 


Sometimes, a oroject wants to register a full user identity which 
corresponds to no real person. This practice wll! work, buf 
should be discouraged unless a good reason can be advanced, since 
it tends to circumvent the access control mechanism. To add a 
fictitious oerson, tyne In the name of the real person in charge 
of the identity to the register command, preceded by an asterisk. 
“ragister™” will then Know that it shoutd not attemot to generate 
a userid = from the name, and will ask for the userid. The names 
beginning with asterisk will be skLloped when mailing tabels are 
generated from the urf. 
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12214 Project Administrators 


Project administrators are registered Multics users who are In 
charge of some rroject. They need not be reaistered on the 
orolect they administer. A singie user may be project 
administrator for many orojectse Each orofect administrator 
aooears in the smf entry for the project he administrates. He 
Nas a copy of the profect*s omf, and may Install @ pdt which he 
creates from this omf with cv_omfs, by use of the Install! command. 
Tha orosject administrator must be abfe to read “proj_admin_seg” 
in order to use the Instati command, and he must have “ea™ access 
on the directory >system_controli_dir>uodate In order to out the 
cony to be instalted where the system can discover it. 


Project administrators should be trustworthy people. They should 
be told to anonoint an alternate if they go on vacation, since it 
is difficult for a system administrator to run ae project which 
nas been delegated to someone else. 


12.15 Project “Multics™ 

Users on the “Multics™ oroject are able to access the privileged 
gate “nhes_" to Investigate the contents of the sunervisor, 
Since they can, therefore, steal oasswords from the Inout 
buffers, onty responsible system programmers should be registered 
on this project. 


12.16 Tarminal repair 


The project “Terminals™ should be set up with one anonymous user 


whose Initial procedure Is “terminals_overseer_" so that 
renote-terminal service personne! can togin and check out a 
terminal. Bumolng should be one and a grace of onty 5 minutes 
set. 


42.217 System operators 


All system operators should be registered on the project 
“Onerator™. This provides them access to the system for the 
ouroose of sending mails document runoff, and harmiess olay. Tt 


is far better to porovide them with a small amourt of disk space 
and sone CPU time of their own, than to discover them using the 
daemons for exoerimenting with the system. 
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ions necessary to keep the systen running 


There are several ano i 
re not yet made Into commands for a restricted 


smoothty which a 
administrator. 


13.1 Disk auota moving 


The daity disk revort lists all! those projects which are flow on 
disk quota. Some of these projects deserve more disks and others 
do not -- they will use uo all that Is avallablte. An 3utomatic 
program could be written to give more disk to those in need, and 
to take quota from those orojects which had extras but the 
algorityms Involved would be complicated and ad hoc» and manual 
adjustment and intervention would stiit be required. 


A restricted system administrator can do some of this quota 
moving, since he has the movequota command available, but if 
takes some experlence, and Is hard to exolain. 


The general strategy is to keep some extra quota on 
>user_dir_dir, avallable for giving fo new projects or to old 
projects which are running out of disk. Issuing the command 


movequota >udd>Alipha 59 


wlll give the project named “Aloha” 50 more records of quota. A 
negative amount will move quota up from a project to >udd. 


The difficulty arises when the free quota on  >udd runs tow. 
There are two possibilities: if the Installation has a total 
quota which is already as much in excess of physical capacity as 
should be attlowed (for instance, If the disk is over 90% 
ohysically full), no more quota should be generated. The 
administrator must either take quota from some other oroject,s or 
from some system directory; or deny the request. Knowledge of 
the various projects® activities and moral suasion may have to be 
emnloyed. A “hotd™ should be put on new oroject registrations, 
toos since new_proj will gripe if it cannot christen a new 
project with enough disk. 


If, on the other hand, the administrator wishes fo raise the 
total quota on the system, say by 1000 records, he should issue 
the command 


sac “setquota > 30003 mq mudd 1000” 
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(assuming the quota on the root Is normally 2000). The 
“seand_admin_command™ (sac) command sends a message to the 
initializer oprocess which wlll be performed as soon as the 
Initializer gets a chance. The command line executes a 


"“satquota™ to increase the root quota, and then executes a 
“moveauota™ to move the quota down to >udd, where it can be 
distributed as usual. 


The sequence described above is the onty filme that the setquota 
command should be used. This Is because the disk-metering code 
In the storage system and the disk-accounting program require 
that disk quota form a “connected tree” wlth no directory which 
has a quota Inferlor to one that does not. 


See Chanter 9 (nage 72) for more information on disk quota 
management. 


13.2 Cl2anup of segments 


Giving the restricted system administrator the “delete” command 
would allow him to destroy any data seqment on the system, 
Therefore, it is up to the full system administrator to clean up 
sejments, especially in >udd>SysAdmin>-admin and Its 
subdirectories, which are no ftonger needed. 


13.3 Load control group management 


New projects will automatically be assigned to the default toad 
control group, “Other”, by the new_proj function. Piacing a 
nproject in a grouo requires modification of the segment 
"smfenen", followed by a new_smf. At that is reauired Is to add 
the line 


group’ Blah: 


after the “nprojectid™ statement which defines a oroject. 
Senerating anew group is done by running the program “ed_mot, 
which is documented in the MPM SPS. 


13.4% Snecial Project requirements 


Creating orivilteged projects, or under-privileged prolects, or 
editing the omf of a oroject to give It snecial treatment, must 
be done oy the full system administrator. Consult the MOM SPS 
writeuos of cv_smf and cv_omf for more information. 
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13.5 Access to project directories 


Access control Is the oparticular province of the system 
administrator. One thing he has to do that canrot be entrusted 
to the restricted system administrator is to provide the various 
project administrators with access to project directories. In 
Some cases, the system administrator may be called upon to alve 
access to one user*’s segments to a user from some other oroject. 
It is imoortant to have someone responsible overforming this 
function, so that Iitt-e-advised or malicious requests can be 
refused. 


13.6 Crash Recovery 


Unrestricted system administrators may be called in to rescue the 
crank or the system administration subdsystem If the system 
crashes while some accounting operation Is In progress. The 
specific steps to take depend on the nature of the crash and on 
the operations being performed when the system went down. 


The worst crashes are those which are foltowed by a reload in 
which some accounting files are fost. Sometimes, this may keep 
the system from starting uo$ or worse, fhe system may start upd, 
but be using old or inconsistent data. Operations should have 
standing orders to contact a system administrator If segments in 
the administrative directories are destroyed. 


More often, the difficulty is fess catastroohic? for Instance, 
the system may crash during a “new_pro]",s and if the new_poroj is 
reoeated it will turn out that a project is In smf.enew twice, 
Restricted system administrators should be told which functions 
cannot be restarted} or told never to do anyfhing more, if the 
system crashed whlie they were doing something, untl! the state 
of the accounting files can be checked. 
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Load control grouns are agroupings of orstects which share 34 
guaranteed access to the system. Each toad control grouno has a 
quota of “primary” load units which represents a guaranteed 
number of users from the group who wlll always be able to Jog In. 
Users In excess of the primary quota will be asslaned “secondary™ 
status and wlll be allowed to fog in if the system is not full. 
Secondary users wlll be preempted If a primary user wants to log 
in and the system is full. Secondary users may be oreempted to 
primary, and thelr grace recatculated, if a orlmary user from the 
group fogs ouf. 


If a groups orimary quota is full and the system is full, a user 
from the grouno will not be permitted to tog In untess he is 
permitted to preemot some orimary user In his group. This 
preemption is under control of the project administrator, who has 
two parameters he may adjust. In order to preempt another user, 
a new user must have the “oreempting™ attribute in the PDT, and 
his project must have the attribute In the SAT. In order to be 
preempted, a primary user must have his “grace” exolre. The 
“grace” Is set by the project administrator in the PDT, subject 
to a maximum grace given in the SAT. 


The attribute flags “no_orimary™ and “no_secondary™ may also be 
set in the POT or the SAT. If a project has the “no_primary® 
attribute, none of Its users may be primary. Similarty, if a 
project has the “no_secondary™ attribute, none of its users may 
be secondary. These flags may also be set by the project 
administrator for individual users. 


The “guaranteed_fogin™ attribute Is used onty for system 
projects. If a user has this attribute In the PDT. and if his 
project has the attribute In the SATs then the user will be 
logged in If at all possible If he specified the “-force™ 
argument to togin. He may overtoad the system In the process of 
fogging ins or may even have to bump a orimary user If the system 
has attained its maximum number of users. 


The accounting system will be set uo with two grouos by the 
accounting cold start. One group is called “System™, and is for 
the use of the daemons and system administration -- those users 
vital to the operation of the system. The rest of the users. on 


the system will be placed in the “Other™ group. To define 
additional load control groups, use the “ed_mgt™ command to edit 
the master grouno table. For examotle, to adda group called 


"SysProyj3” and to give It to the project called “Multics™, perform 
the following operations from an unrestricted system 
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adninistrator? 


ed_mgt >system_contro!l_dir>master_group_table 
a SysProg 5 

w 

q 


edn smf.new 

| orojectids Multics? 
i 3roup? SysProg: 
Ww 
q 


ec master new_smf 


Tha control parameters for a group are its orimary quota, 
exoressed as 


constant + max_units * numerator / denominator 


so that the number of unlts allocated to a group kas a gquarantee 
and a oortion which varies with the number of unlts altowed on 
the sysfem’ and, ootionally, an absolute maximum rumber of units 
for th? groun, orimary or secondary, This maximum Is also 
exoressed as 


constanti + max_units * numeratori / denominatorti 


The absolute maximum can be used If you nrefer to see the system 
at less than maxunits rather than having many secondary users in 
some grouo’t this strategy may provide better response for those 
us2rs who do get togged In. A orimary quota of “-1" for a grouno 
indicates that the groun should take “all the rest” of the 
orimary quota on the system, after those groups which have fixed 
quotas have been deducted from maxunits. No more than one  grouo 
should have a quota of "“-1", or havoc will result. The total of 
alt orimary quotas must not add up to more than maxunits. 
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The following is a list of the writeups which contain additional 
Information about the system administration facliltys its 
orograms and data bases. 


Multics System Programmers Manual 


Tne published documents on system and =user- control In. 
section 8Q are almost completely worthiess. They describe 
orograms which were never used, and In most cases never 
written. In some cases, one can discover design principles 
mentioned in these old documents which have been followed In 
the construction of today*s facilities. 


A comotetely new section 8Q Is being prepared, which will 
provide an overview of the system and user contro! 
facliities actually part of the system. This project is not 
high-crlority. 

Multics Programmer’*s Manual | 
See section 1.2, “Logging in", and the command writeups for 
"login™ and “fogout”™. 


Multics System Administrator’s Manual 


This document. 


Multics Project Administrator's Manual 
Describes the duties and powers of the project 
administrator. A copy of this document should be given fo 
each project administrator. 


On-line help segments 


Sea the segments “charges.info™, “ltoad_ctt.info™, 
“ltogin.einfo", and “user_control.info™. 
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Multics Programmer's Manual - System Programmer’*s Suoptement 


Thea currently Instatted programs which support 
administration and user controt are documented in this 
manual. The writeups to read will be listed by category. 


System Control 


system_stfartuo_ - system ring 1 overseer 
system_contro!_ - system user-ring overseer 
sys _log_ - initializer error messages 


User Control and Answering Service 


absentee_user_manager_ - absentee Job control 
absentee_utility_ - absentee job scheduler & utitity 
act_cTtl_ - accounting 

adnin - onerator commands 

as_ - answering service startup 

as_meter_ - system metering 

asu_ - ftyoewriter attachment 

aswa_ - tyoewriter and network i/o 

cp3_ - process creation 

datebin_ - date conversion utllity 

dhodh_ - access checking utltity 

dial_cti_ - slave console control 

dialun_ - line control, togin tine oarse, togout 
dog. - orocess destruction 

hash_ - hash table utility 

hash_Index - hashing function 

Ig_cttl_ - ftogin decision, user identification 
load_cti_ - load control] decision 

not_ascli_ - string-checking utllity 

rehash_ - hash tabte utility 

scramble_ - password scrambling 

test_dialup - testing tool 

up_opdt_ - odt validation and uodating 

uDpD_ont_ - pnt validation and updating 
un_sat_- sat validation and unodating 
up_sysct!_- system table update control 


Administration and billing 


access _name - add or delete access control names in UCT 
acctounts_overseer_ - Initial procedure for administrator 
adyin_utIl! - flock and unlock sys_admin_data 

as_who - porivileged who, for operator and admin. 

char ge_daemon_usage ~- J90 daemon charges from deck to POT 
charqe_disk - charge disk to projects 
charqge_projects_to_accts - monthty billing 


Multics System Administrator’s Manual Page 93 
01/09/73 rev 3 


Bibtilography 


MPM SPS Sections 


charge_user_ - POT modification utitity 
charge_user_registration - monthiy billing 
charge_users_to_accts - monthly bitting 
clear_prolfile - monthiy blitina. cleanuo 
clear_reaqfile - monthty bilfing, cleanup 
compute_bill - daily billing 

console_edit - utitity to update termseg 
console_report - generate console report by id code 
copy_as_meters - copy stat_seg for statistics report 
cony_ont - make ont cooy for testing with blank passwords 
creaate_tines_file - installation startup too! 
cv_persmf - compite persmf into pnt (obsolete) 
cv_pmf - compile omf Into odt 

cv_smf - compilte smf into sat 

daemon_acct_print - print daemon accounting deck 
dally_tog_process - generate reports from log 
daily_summary - daity billing report 
disk_stat_orint - print disk charge flaqures 
disk_usage_stat - sweep disk and orint statistics 
disklow - report on projects tow on disk 
dunp_anstbl!l - dump answer table for debugging 
ed_instatilation_parms - edit instattlation pcarameters 
ed_mgt - edit master group table 

edurf - edit user realstration segment 

enoro - edit project segment 

erf = edit requisition segment 

fill_urf - pass through urf, get missing data 
format_attributes_ - outout format utility 

get _nassword_ - oassword reading utlility 
get_uid_with_lastname - search urf for tast name 
get_user_ - monthly billing subroutine 

hash_table - hash table maintenance 

idsort_ - fast sorting utility 

instal! - instal! system tabtes 

is_he_user - active function 

is_legal_pro} - actlve function 

flabiit - orint billing labels 

malling_labels - orint user labels 

merg - monthly billing 

merge_urf_ont - obsolete 

misc - Input miscellaneous charges 

new_user - register or change user 

pdf_cony - cony all POT*s to safe directory 

poro - orint orojfile 

orinf_disk - print project disk charges 

or int_tog - print log segment 

orint_meters - create statistics report 

orint_odt - print pdt 
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MPM SPS Sections 


orint_ont - orint ont 

orint_ sat - print sat 

nrocess_daemon_cards - dally billing 
orocess_session_cards - daily bliting 

proj _mtd - month-to-date project report 

oro) _usaqe_reoort - month-to-datfe oroject renort 
punch_MIT_deck - monthly billing 

afo - print reafile 

remove_user - unregister user 

rename_onts_ - utility for new_user 
reset_disk_meters - monthly reset of disk meters 
reset_rrocessed_flag - natch accounting deck flags 
reset_usage - reset usage data in PDT 
reset_use_totals - reset usage totals for reports 
send_admin_command - send command to initiatizer 
sef_admin_data_ - locking subroutine for sys _admin_data 
sort_hist_file - sort billina data base 
sort_crojfile - sort project database 
sort_reqfile - sort reaquisition data base 

sweep ~- disk quota and charge accounting 
sweep_disk_ - disk hlerarchy sween 
Sys_full_renort - reoort on refused flogins 
system_dally_report - write daily report 
Ssystem_monthly_report - write monthly resort 
system_total - comoute system availabltity for reports 
terminals_overseer_ - terminal repair Init proc 
up_ctr - update charges this requisitions, monthtly 
urfo - orint urf 

urfsort - sort urf 

usage_total - comoute system usage for reports 
vafue - active functlon and command 

write _acct_bil!l - monthiy blitting 

write_bilting_ summary - monthly blilina 
write_user_usage_report - monthly blitting 


Data Bases 


answer_tabfe - answering service user database 
communications - system control password 
disk_stat - disk charge figures 
instaltation_oarms - instatlation poarameters 
TO__ accounting - daemon accounting deck 

loj - answering service fog 

miscfile - miscelfaneous charges journal 


mat - master grouo fable 
odt - project definition table 
oit - process initialization table 


ont - person name table 
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- MPM SPS Sections 


oroj_admin_seg - system tabfe Installation 
projfile - project seqment 

reqfife - requisition segment 

sat - system administfrator’s tTabdie 

stat_seg - answering service statistics 
sys_admin_data - system administration lock 
urf - user registration segment 

use_totals - report data base 

wnhotab - oublic tist of users loagedg In 


master.ec - system administrator commands 
biller.ec ~- billing operations 

err.ec - administration errors 

util.ec - administration utitity 

acct_start_up.ec - installation accounting startuo 
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Aooendix 13 Samole forms 


Generating a few workftiow forms for the use of the user 


accounting office can simo!tify the oneration noticeably. The 
forms will enable you to make sure that the necessary Information 
is canotured,. Fach Installation wil! have Its own soecullar 


regjuiremnents for these forms, $o no general scheme is orovided. 
Samples of the forms in use at MIT are attached. 


You will orobably want the foltfowings: 
person reaistration form 
oroject registration form 
project detetion forn 
taoe registration form | 
retrieval request form 
system problem/complaint forn 
credit request form 
card processing request form 
configuration change log 
Roger says 
user accounts all-ourpose ftetter 
user taoe log 
miscellaneous charge inouft 
crash form 


backun tape log 


Massachusetts Institute of Technology 


Information Processing Center 


Person Registration for Multics System 


This form is only needed for peoole who have never been 
resistered on Multics before. 


2S Bt 2 a a ee ee a ae re el 
Last First Middle 

Mailing address Si aie i Se a a 

Tefenhone es ial ah ee a a oa, 

Programmer number __ a tsCiUCSFs Ny) 


Each oerson registered on the Multics system is assigned a 1-246 
character “Person ID", which is unique at this IiInstattation. The 
person [0 Is usually the tast name (beginnina with a capital 
letter) Lf nossible? If someone else with the same name Is 
already registered, the person [9 will be the tast name with 
Initlalts prefixed (e.9. Smiths JSmith, JRSmIth). 


Nefault oroject TOD 


eS SD ES RD EE A SER RS aN RD NO SINE AD 


Registered persons must also be authorized to use ao ovoarticular 
oroject by the project administrator for the poroject. 


Please attach a slip of paper with a personal password. Your 
password may be 1-8 characters (letters and digits only). 


You may chanae your default project ID or your password on-!ine 
any time you wish? consult the Multics Programmer’s Manual. 


Please return this form to? 
Information Processing Center 
User Accounts Office, room 39-513 
MoIsT.2 77 Massachusetts Avenue 
Cambridgesy Massachusetts 02139 


If you have any probfems with your registration, please contact 
the User Accounts Office (253-4118). 


Peo lurcaiemmmmnn primhasaednameeetamealieenake onaiteesamatanedimeanademnentamemeniataethtiesdndhenmetemeattenanbaannetannemametamenmanmmatammattemetasemtaniel 7 7 Ne rere ee mre SS rat SE a Se ie See ie a 


form revised 93/72 


Massachusetts Institute of Technoloay 


Information Processing Center 


Project Registration for Multics System 


Project Titte 


SD Ee RES, ED AE OES SSE SED AEE AE OS CRED AES ERE AT SEAN SS IRC SSE CR SE ED NEARS CEA, PATNA RS LEED REIT TR CE ACD SLES EAS SIE TS HDS IEDR 


Princioal Investigator 


Address 


Se OS SI I NED SAEED ED EEN ET SO NS EDT A ES SOCRATES RD CD SENATE SEY CSL SAA EDS COG BTS APIO HS MIA AD ASEM ACEP AS SRA 


Project Supervisor 


Address 


EPO EP AY CEL SAD AE ATE LS ETD TY ITA CERN CASED OARS SL NES OAS AMER a POTD ARIS SED MEME AED BEY AAAI LIAL ESS EY OEE SE OEE 


Phone 


Each oroject is assigned a “Project ID™ (1-9 characters beginning 
with a capital tetter) for Identification and access contro! 
ournoses. Please suggest a oroject I0 for your project? 


EP OE ER EES ER ENR iain CO A ELENA RS ES 


Initial disk quota records (default 25) 


RE ia CEE AY RE ES ET ea AERE IY REET 


MIT acct Requisition or P.0. 


ERI ew tiene ORE Geeta REPRE SIE COREA ERATO LOAM CEU antane Wate et ere tee 


If you wish to administer your oroject on-line, olease supply the 
following information? 


Directory for PMF 


Re eat ERR a cee ins ERE mR A CE oR REE RETR EOR EERE Rin RAL Ania meio ari elie SES RSE ER pe RE NS AEN PRA ce MER AT A SRS 


Administrator (Person.Project) 


Project ID Assigned _._ a es eas 


form revised 9/72 


TO% 


Massachusetts Institute of Technology 


Information Processing Center 
Multics Project Administration Request 


User Accounts Offices MIT 39-513 


FROMS 


MEE SE at De aR eS SS ea SEE Rec ES EA cht GES PE IAP AERO copmrenimrencte tare meer <cramealfte Cleanse sae 


DATE? 


SUBJECT$3 Project ID 


[ ] 


Date done by 


ES ORES ME eh EAE EEE ALN SE STE EN 


Please delete the project and all Its disk storage. Scratch 
alt tapes and release ali lockers associated with the 
project. 

Please add the foltowing persons to the project. Person 
registration forms are attached for any persons not 


orevloustly registered, 


OS we Se SO CE A ED OE ES a ED Ge ETS eh REY ORE SARS SEES REIS SED EES SS OG CRT TED LP CFG EA SE 
ee aS Ee ee Ee ES EEE RE a EE EET A A SONS ee ED 


Please delete the following persons from the project. Do not 
delete thelr directories. 


Sh ee ask a CE a SRE EE RES EE CES SE a a ee ee ee pecan CE RN TE ET ATS ND RE hai CaS wit 
Ae ee rR TE ET ERE TEES TOY EERE ATS me ae SR RARE cea aOR i> RAI mai SNE ADE a RD aa NSS A AE Ra A DD ch ora RY 


Please give project administrator status to the folloning 
user (1l.e. delegate the vroject). 


Directory for PMF 


Administrator (Person.Project) 


form revised 9/72 


Massachusetts Institute of Technolocy 


Information Processing Center 


Multics Project Administration Request Confirmation 


TO: {Project suvervisor) eS a ER REST RCE REF PST DN eR EL 
FROM? User Accounts Offices MIT 39-5133 253-4118 
NATE? es, SN ee Sere 


SUBJECT: Project ID 


{ } 


A ON eS ERE I eS EER ES ATT LE OA aN SY SND SEO AE, SAAD Shar A A 


Your project has been set up on Multics as reauested. 
Your oroject has been deleted as requested. 


The foltowing users have been added to your project. 


EE OE ED A CELE RRR EEN AONE ORT RO SES A RTE LTS AEE LE SPRAY EE LLL ESRI ELE AEE RELL ITTT SPEIRS PASS TEE SSO: AST 
aR ee A ER EERE EY eS I ED GORE! EIA eR AEA ALCL RTE CATT E ES NNETISY S EER Ce RETRY TS I ANS AERIS EERO CS MORIN At OR OD TBE 


A OE RO EY OTD EE ER ES ee Se Se eT ETD AT EME A CSE “APES RED CETTE Se 


The following users have been deleted from your oroject. You 
should delete their directories once you nave copied any. 
segments which you wish to oreserve. 


SE ca RS en AR cele KERR SIE CEN SRE SET SEE rene ea seg SAAR ED A EE SACRA EEA AAS ap A AR NESE: EE TEE TAI LD SLIT ALES ED ETE to EE 
Re inde nove oe ca ATE ESE SN REE RE Mar oY CIT (EE Aenean AER SD ere te ED ON cane bt A CER en a EET CS EY EE A Mc A va a RSPR AE Aizen 


AE Ce eID SE REE eae SE RA REE LR A ED (Seas CE eS Ae EE ee coi ee 


{ 1} Your project has been delegated to a oprofect administrator. 
He may now add and delete users and control resource fimits. 
Dir @eTORY (OR PR finan i he Se es 
Administrator (Person.Project) _ 

Date done = Sees OM a pee Tt Ay 
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